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Section I 

INTRODUCTORY REMARKS 

Paragraph 
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Primary classification of periodic systems 3 
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1. The essential difference between monoalphabetic and polyalphabetic substitution. — a. 
In the substitution methods thus far discussed it has been pointed out that their basic feature' 
is that of monoalphabeticity. From the cryptanalytic standpoint, neither the nature of the 
cipher symbols, nor their method of production is an essential feature, although these may be 
differentiating characteristics from the cryptographic standpoint. It is true that in those cases 
designated as monoalphabetic substitution with variants or multiple equivalents, there is a 
departure, more or less considerable, from strict monoalphabeticity. In some of those cases, 
indeed, there may be available two or more wholly independent sets of equivalents, which, 
moreover, may even be arranged in the form of completely separate alphabets. Thus, while a 
loose terminology might permit one to designate such systems as polyalphabetic, it is better to 
reserve this nomenclature for those cases wherein polyalphabeticity is the essence of the method, 
specifically introduced with the purpose of imparting a positional variation in the substitutive 
equivalents for plain-text letters, in accordance with some rule directly or indirectly connected 
with the absolute positions the plain-text letters occupy in the message. This point calls for 
amplification. 

b. In monoalphabetic substitution with variants the object of having different or multiple 
equivalents is to suppress, so far as possible by simple methods, the characteristic frequencies 
of the letters occurring in plain text. As has been noted, it is by means of these characteristic 
frequencies that the cipher equivalents can usually be identified. In these systems the varying 
equivalents for plain-text letters are subject to the free choice and caprice of the enciphering 
clerk; if he is careful and conscientious in the work, he will really make use of all the different 
equivalents afforded by the system; but if he is slip-shod and hurried in his work, he will use the 
same equivalents repeatedly rather than take pains and time to refer to the charts, tables, or 
diagrams to find the variants. Moreover, and this is a crucial point, even if the individual 
enciphering clerks are extremely careful, when many of them employ the same system it is entirely 
impossible to insure a complete diversity in the encipherments produced by two or more clerks 
working at different message centers. The result is inevitably to produce plenty of repetitions 
in the texts emanating from several stations, and when texts such as these are all available for 
study they are open to solution, by a comparison of their similarities and differences. 

c. In true polyalphabetic systems, on the other hand, there is established a rather definite 
procedure which automatically determines the shifts or changes in equivalents or in the manner 
in which they are introduced, so that these changes are beyond the momentary whim or choice of 
the enciphering clerk. When the method of shifting or changing the equivalents is scientifically 
sound and sufficiently complex, the research necessary to establish the values of the cipher 
characters is much more prolonged and difficult than is the case even in complicated monoalpha- 
betic substitution with variants, as will later be seen. These are the objects of true polyalpha- 
betic substitution systems. The number of such systems is quite large, and it will be possible to 

( 1 ) 
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describe in detail the cryptanalysis! of only a few of the more common or typical examples of 
methods encountered in practical military communications. 

d. The three methods, (1) single-equivalent monoalphabetic substitution, (2) monoalpha- 
betic substitution with variants, and (3) true polyalphabetic substitution, show the following 
relationships as regards the equivalency between plain-text and cipher-text units: 

A. In method (1), there is a set of 26 symbols; a plain-text letter is always represented by 
one and only one of these symbols ; conversely, a symbol always represents the same plain-text 
letter. The equivalence between the plain-text and the cipher letters is constant in both enci- 
pherment and decipherment. 

B. In method (2), there is a set of n symbols, where n may be any number greater than 26 
and often is a multiple of that number; a plain-text letter may be represented by 1, 2, 3, . . . 
different symbols; conversely, a symbol always represents the same plain-text letter, the same as 
is the case in method (1). The equivalence between the plain-text and the cipher letters is 
variable in encipherment but constant in decipherment. 1 

C. In method (3) there is, as in the first method, a set of 26 symbols; a plain-text letter 
may be represented by 1, 2, 3, . . . 26 different symbols; conversely, a symbol may represent 
1, 2, 3, . . . 26 different plain text letters, depending upon the system and the specific key. 
The equivalence between the plain-text and the cipher letters is variable in both encipherment 
and decipherment. 

2. Primary classification of polyalphabetic systems. — a. A primary classification of poly- 
alphabetic systems into two rather distinct types may be made: (1) periodic systems and (2) 
aperiodic systems. When the enciphering process involves a cryptographic treatment which is 
repetitive in character, and which results in the production of cyclic phenomena in the crypto- 
graphic text, the system is termed periodic. When the enciphering process is not of the type 
described in the foregoing general terms, the system is termed aperiodic. The substitution in 
both cases involves the use of two or more cipher alphabets. 

b. The cyclic phenomena inherent in a periodic system may be exhibited externally, in 
which case they are said to be patent, or they may not be exhibited externally, and must be un- 
covered by a preliminary step in the analysis, in which case they are said to be latent. The 
periodicity may be quite definite in nature, and therefore determinable with mathematical 
exactitude allowing for no variability, in which case the periodicity is said to b & fixed. In other 
instances the periodicity is more or less flexible in character and even though it may be deter- 

1 There is a monoalphabetic method in whioh the inverse result obtains, the correspondence being constant 
in encipbermeit but variable in decipherment; this is a method not found in the usual books on cryptography 
but in an essay on that subject by Edgar Allan Poe, entitled, in some editions of his works, A Jew words on secret 
writing and, in other editions, Cryptography. The method is to draw up an enciphering alphabet such as the 
following (using Poe’s example): 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher SUAVITERINMODOFORTITERINRE 

In such an alphabet, because of repetitions in the cipher component, the plain-text equivalents are subject to a 
considerable degree of variability, as will be seen in the deciphering alphabet: 

Cipher ABCDEFGHIJKLMNOPQRSTUVWXYZ 

{ C MGO E KJL HAFBD 

U I X N Q R 

Z S PVT 

W Y 

This type of variability giveB rise to ambiguities in decipherment. A cipher group such as TIE. would yield 
such plain-text sequences as REG, FIG, TEU, REU, etc., which could be read only by context. No system of such a 
character would be practical for serious usage. For a further discussion of this type of cipher alphabet see 
Friedman, William F., Edgar Allan Poe, Cryptographer, Signal Corps Bulletins Nos. 97 and 98, 1937-38. 
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r, 

minable mathematically, allowance must be made for a degree of variability subject to limits 
controlled by the specific system under investigation. The periodicity is in this case said to be 
flexible, or variable within limits. 

8. Primary classification of periodic systems. — a. Periodic polyalpbabetic substitution 
systems may primarily be classified into two kinds: 

(1) Those in which only a few of a whole set of cipher alphabets are used in enciphering 
individual messages, these alphabets being employed repeatedly in a fixed sequence throughout each 
message. Because it is usual to employ a secret word, phrase, or number as a key to determine 
the number, identity, and sequence with which the cipher alphabets are employed, and this 
key is used over and over again in encipherment, this method is often called the repeating-key 
system, or the repeating-alphabet system. It is also sometimes referred to as the multiple-alpha- 
bet system because if the keying of the entire message be considered as a whole it is composed 
of multiples of a short key used repetitively. 2 In this text the designation “repeating-key 
system” will be used. 

(2) Those in which all the cipher alphabets comprising the complete set for the system are 
employed one after the other successively in the encipherment of a message, and when the 
last alphabet of the series has been used, the encipherer begins over again with the first alphabet. 
This is commonly referred to as a progressive-alphabet system because the cipher alphabets are 
used in progression. 

4. Sequence of study of polyalphabetic systems. — a. In the studies to be followed in con- 
nection with polyalphabetic Bystems, the order in which the work will proceed conforms very 
closely to the classifications made in paragraphs 2 and 3. Periodic polyalphabetic substitution 
ciphers will come first, because they are, as a rule, the simpler and because a thorough under- 
standing of the principles of their analysis is prerequisite to a comprehension of how aperiodic 
systems are solved. But in the final analysis the solution of examples of both types rests upon 
the conversion or reduction of polyalphabeticity into monoalphabeticity. If this is possible, 
solution can always be achieved, granted there are sufficient data in the final monoalphabetic 
distributions to permit of solution by recourse to the ordinary principles of frequency. 

b. First in the order of study of periodic systems will come the analysis of repeating-key 
systems. Some of the more simple varieties will be discussed in detail, with examples. Subse- 
quently, ciphers of the progressive type will be discussed. There will then follow a more or less 
detailed treatment of aperiodic systems. 



1 French terminology calls this the “double-key method”, but there is no logic in such nomenclature. 
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Section II 

CIPHER ALPHABETS FOR POLYALPHABETIC SUBSTITUTION 

Paragraph 



Classification of cipher alphabets upon the basis of their derivation 5 

Primary components and secondary alphabets 6 

Primary components, oipher disks, and square tables 7 



6. Classification, of cipher alphabets upon the basis of their derivation. — a. The substitu- 
tion processes in polyalphabetic methods involve the use of a plurality of cipher alphabets. 
The latter may be derived by various schemes, the exact nature of which determines the principal 
characteristics of the cipher alphabets and plays a very important role in the preparation and 
solution of polyalphabetic cryptograms. For these reasons it is advisable, before proceeding to a 
discussion of the principles and methods of analysis, to point out these various types of cipher 
alphabets, show how they are produced, and how the method of their production or derivation 
may be made to yield important clues and short-cuts in analysis. 

b. A primary classification of cipher alphabets for polyalphabetic substitution may be made 
into the two following types: 

(1) Independent or unrelated cipher alphabets. 

(2) Derived or interrelated cipher alphabets. 

c. Independent cipher alphabets may be disposed of in a very few words. They are merely 
separate and distinct alphabets showing no relationship to one another in any way. They may 
be compiled by the various methods discussed in Section IX of Elementary Military Cryptography. 
The solution of cryptograms written by means of such alphabets is rendered more difficult by 
reason of the absence of any relationship between the equivalents of one cipher alphabet and 
those of any of the other alphabets of the same cryptogram. On the other hand, from the point of 
view of practicability in their production and their handling in cryptographing and decryptograph- 
ing, they present some difficulties which make them less favored by cryptographers than cipher 
alphabets of the second type. 

d. Derived or interrelated alphabets, as their name indicates, are most commonly produced 
by the interaction of two primary components, which when juxtaposed at the various points of 
coincidence can be made to yield secondary alphabets. 1 

6. Primary components and secondary alphabets. — Two basic, slidable sequences or com- 
ponents of n characters each will yield n secondary alphabets. The components may be classi- 
fied according to various schemes. For cryptanalytic purposes the following classification will be 
found useful: 

Case A. The primary components are both normal sequences. 

(1) The sequences proceed in the same direction. (The secondary alphabets are direct 
standard alphabets.) (Pars. 13-15.) 

(2) The sequences proceed in opposite directions. (The secondary alphabets are reversed 
standard alphabets; they are also reciprocal cipher alphabets.) (Par. 13i, 14p.) 

Case B. The primary components are not both normal sequences. 

(1) The plain component is normal, the cipher component is a mixed sequence. (The 
secondary alphabets are mixed alphabets.) (Par. 16-25.) 

1 See See. VIII and IX, Elementary Military Cryptography. 

( 4 ) 
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(2) The plain component is a mixed sequence, the cipher component is normal. (The 
secondary alphabets are mixed alphabets.) (Par. 26.) 

(3) Both components are mixed sequences. 

(a) Components are identical mixed sequences. 

I. Sequences proceed in the same direction. (The secondary alphabets are 
mixed alphabets.) (Par. 28.) 

II. Sequences proceed in opposite directions. (The secondary alphabets are 
reciprocal mixed alphabets.) (Par. 38.) 

(b) Components are different mixed sequences. (The secondary alphabets are mixed 

alphabets.) (Par. 39.) 

7. Primary components, cipher disks, and square tables. — a. In preceding texts it has 
been shown that the equivalents obtainable from the use of quadricular or square tables may be 
duplicated by the use of revolving cipher disks or of sliding primary components. It was also 
stated that there are various ways of employing such tables, disks, and sliding components. 
Cryptographically the results may be quite diverse from different methods of using such para- 
phernalia, since the specific equivalents obtained from one method may be altogether different 
from those obtained from another method. But from the cryptanalytic point of view the 
diversity referred to is of little significance ; only in one or two cases does the specific method of 
employing these cryptographic instrumentalities have an important bearing upon the procedure 
in cryptanalysis. However, it is advisable that the student learn something about these different 
methods before proceeding with further work. 

b. There are, not two, but Jour letters involved in every case of finding equivalents by means 
of sliding primary components; furthermore, the determination of an equivalent for a given 
plain-text letter is representable by two equations involving four elements, usually letters. 
Three of these letters are by t hi s time well-known to and understood by the student, viz, 0 k , 0 D , 
and 0 C . The fourth element or letter has been passed over without much comment, but crypto- 
graphically it is just as important a factor as the other three. Its function may best be indicated 
by noting what happens when two primary components are juxtaposed, for the purpose of finding 
equivalents. Suppose these components are the following sequences: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) F B P Y R C Q Z I G S E H I D J U M K V A L W N 0 X 

Now suppose one is merely asked to find the equivalent of P„ when the key letter is K. Without 
further specification, the cipher equivalent cannot be stated ; for it is necessary to know not only 
which K will be used as the key letter, the one in the component labeled (1) or the one in the 
component labeled (2), but also what letter the K k will be set against, in order to juxtapose the 
two components. Most of the time, in preceding texts, these two factors have been tacitly 
assumed to be fixed and well understood: the K* is sought in the mixed, or cipher component, 
and this K is set against A in the normal, or plain component. Thus: 

Plain Index 

(1) Plain ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) Cipher FBPYRCQZIGSEHTDJUMKVALWNOX 

t t 

Cipher Key 



With this setting P p =Z„. 
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c. The letter A in this case may be termed the index letter, symbolized Aj. The index letter 
constitutes the fourth element involved in the two equations applicable to the finding of equiva- 
lents by sliding components. The four elements are therefore these: 

(1) The key letter, 0* 

(2) The index letter, 9j 

(3) The plain-text letter, 0 P 

(4) The cipher letter, 0„ 

The index letter is commonly the initial letter of the component; but this, too, is only a con- 
vention. It might be any letter of the sequence constituting the component, as agreed upon by 
the correspondents. However, in the subsequent discussion it will be assumed that the index letter 
is the initial letter oj the component in which it is located, unless otherwise stated. 

d. In the foregoing case the enciphering equations are as follows: 

(I) K*=A,; P D =Z, 

But there is nothing about the use of sliding components which excludes other methods of finding 
equivalents than that shown above. For instance, despite the labeling of the two components 
as shown above, there is nothing to prevent one from seeking the plain-text letter in the com- 
ponent labeled (2), that is, the cipher component, and taking as its cipher equivalent the letter 
opposite it in the other component labeled (1). Thus: 

Cipher Index 

4 4 

(1) ABCDEFGHIJKLMN0PQRSTUVW3CYZABCDEFGHIJKLMN0PQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALWNOX 

t t 

Plain Key 

Thus: 

(II) K k =A,; P P =K, 

e. Since equations (I) and (II) yield different resultants, even with the same index, key, 
and plain-text letters, it is obvious that an accurate formula to cover a specific pair of enciphering 
equations must include data showing in what component each of the four letters comprising the 
equations is located. Thus, equations (I) and (II) should read: 

(I) K k in component (2)=A t in component (1); P p in component (l)=Z e in component (2). 

(II) K k in component (2)=A| in component (1); P p in component (2)= K„ in component (1). 

For the sake of brevity, the following notation will be used: 

(1) K k /*=Aj/j; P p /i=Z e /j 

(2) K k /j=Aj/i; Pp/a=K e/ i 

/. Employing two sliding components and the four letters entering into an enciphering 
equation, there are, in all, twelve different resultants possible for the same set of components 
and the same set of four basic elements. These twelve differences in resultants arise from a set 
of twelve different enciphering conditions, as set forth below (the notation adopted in sub- 
paragraph e is used): 

(1) 0M=e,/i; 0p/i=9 e /i (7) 0 k /s=0pfl; 0|/J=0e/1 

(2) 0 k /a=9in; 0 p /i=0 o /i (8) 0i:/j=0o/i; 0i/»=0 p /i 

(3) ©m= 6 i/a? ©p/i=©«fl (9) 0 k /i s =0 p /*; 0i/i=0e/s 

(4) 0m=0i/>; 0p/*=© c /i (10) 0 k /i=0o/a» 9i/i=0p/» 

(5) 0 k /a=0 pfl ; 0i/i—0e/i (11) 0n/i=0p/i; 0 i/s=0«a 

(6) 0kfl=9s/i; 6i/i=0p/i (12) 0k/i=0«/i; 0i/s=0p n 



REF ID:A64565 



7 

g. The twelve resultants obtainable from juxtaposing sliding components as indicated under 
the preceding subparagraph may also be obtained either from one square table, in which case 
twelve different methods of finding equivalents must be applied, or from twelve different square 
tables, in which case one standard method of finding equivalents will serve all purposes. 

A. If but one table such as that shown below as Table 1-A is employed, the various methods 
of finding equivalents are difficult to keep in mind. 

Table I-A 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 



F 


B 


P 


Y 


R 


C 


Q 
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G 


S 
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H 


T 


D 


J 


U 


M 


K 
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A 


L 


W 


N 


0 


X 


B 


P 


Y 


R 


C 


Q 


z 


I 


G 


S 




H 


T 


D 


J 


U 


M 


K 


V 


A 
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ff 


N 
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I 
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E 
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For example: 

(1) For enciphering equations 0k/i=0i/i; 9 P /i=0 o /»: 

Locate 0 P in top sequence; locate G* in first column; 

©ois letter within the square at intersection of the two lines thus determined. 
Thus: 



Kk/j=A 1 /i; P p /i=Z 0 /a 
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(2) For enciphering equations ©k/s=0 t /i; ©p/a=©c/i: 

Locate 0* in first column; follow line to right to 0 P ; proceed up this column; 0 O is 
letter at top. 

Thus: 

Kk/j=Ai/i; Pp/a=Kc/i 

(3) For enciphering equations 0 k /i=0 i/2 ; 0 p/ i=0 c/2 : 

Locate 0* in top sequence and proceed down column to 0, ; 

Locate © p in top sequence; 0„ is letter at other comer of rectangle thus formed. 
Thus: 

Kk/i = Ai/a; P p /i=X 0 /2 



Only three different methods have been shown and the student no doubt already has encountered 
difficulty in keeping them segregated in his mind. It would obviously be very confusing to try 
to remember all twelve methods. But if one standard or fixed method of finding equivalents is 
followed with several different tables, then this difficulty disappears. Suppose that the following 
method is adopted: Arrange the square so that the plain-text letter may be sought in a separate 
sequence, arranged alphabetically, above the square and so that the key letter may be sought 
in a separate sequence, also arranged alphabetically, to the left of the square; look for the plain- 
text letter in the top row; locate the key letter in the 1st column to the left; find the letter stand- 
ing within the square at the intersection of the vertical and horizontal lines thus determined. 
Then twelve squares, equivalent to the twelve different conditions listed in subparagraph/, can 
readily be constructed. They are all shown in Appendix 1, pp. 96-107. 

i. When these square tables are examined carefully, certain interesting points are noted. 
In the first place, the tables may be paired so that one of a pair may serve for enciphering and the 
other of the pair may serve for deciphering, or vice versa. For example, tables I and II bear this 
reciprocal relationship to each other; III and IV, V and VI, VII and VIII, IX and X, XI and 
XII. In the second place, the internal dispositions of the letters, although the tables are derived 
from the same pair of components, are quite diverse. For example, in table I-B the horizontal 
sequences are identical, but are merely displaced to the right and to the left different intervals 
according to the successive key letters. Hence this square shows what may be termed a hor- 
izontally-displaced, direct symmetry of the cipher component. Vertically, it shows no symmetry, 
or if there is symmetry, it is not visible. 2 But when Table I-B is more carefully examined, an 
invisible, or indirect, vertical symmetry may be discerned where at first glance it is not apparent. 
If one takes any two columns of the table, it is found that the interval between the members of 
any pair of letters in one column is the same as the interval between the members of the homolo- 
gous pair of letters in the other column, if the distance is measured on the cipher component. For 
example, consider the 2d and 15th columns (headed by L and I, respectively) ; take the letters P 
and G in the 2d column, and J and W in the 15th column. The distance between P and G on the 
cipher component iB 7 intervals; the distance between J and W on the same component is also 
7 intervals. This phenomenon implies a kind of hidden, or latent, or indirect symmetry within 
the cipher square. In fact, it may be stated that every table which sets forth in systematic fashion 
the various secondary alphabets derivable by sliding two primary sequences through all points of 
coincidence to find cipher equivalents must show some kind of symmetry, both horizontally and 

2 It is true that the first column within the table shows the plain-component sequence, .but this is merely 
because the method of finding the equivalents in this case is such that this sequence is bound to appear in that 
column, since the successive key letters are A, B, C, . . . Z, and this sequence happens to be identical with 
the plain component in this case. The same is true of Tables V and XI; it is also applicable to the first row of 
Tables IX and X. 
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vertically. The symmetry may be termed visible or direct, if the sequences of letters in the rows 
(or col umn s) are the same throughout and are identical \rith that of one of the primary com- 
ponents; it may be termed hidden or indirect if the sequences of letters in the rows or columns 
are different, apparently not related to either of the component^, but are in reality decimations 
of one of the primary components. 

j. When the twelve tables of Appendix 1 are examined in the light of the foregoing remarks, 
the type of symmetry found in each may be summarized in the following manner: 





Horizontal 


Vertical 


Table 


Visible or direct 


Invisible or Indirect 


Visible or direct 


Invisible or indirect 




Follows 

plain 

component 


Follows 

cipher 

component 


Follows 

plain 

component 


Follows 

cipher 

component 


Follows 

plain 

component 


Follows 

cipher 

component 


Follows 

plain 

component 


Follows 

cipher 

component 


I. 




X 














II 






x 








x 




III.. .. . _ 




X 








x 




B 


IV 






X 




x 








V 




X 












X 


VI 






X 








X 




VII 


x 












x 




VIII 


x 












X 




IX 








X 








x 


X 








X 








x 


XI 






X 




X 








XII . . 




X 








X 








1 

















Of these twelve types of cipher squares, corresponding to the twelve different ways of using a 
pair of sliding primary components to derive secondary alphabets, the ones best known and 
most often encountered in cryptographic studies are Tables I-B and II, referred to as being of 
the Vigenfere type; Tables V and VI, referred to as being of the Beaufort type; and Tables IX 
and X, referred to as being of the Delastelle type. It will be noted that the tables of the Dela- 
stelle type show no direct or visible symmetry, either horizontally or vertically and because of 
this are supposed to yield more security than do any of the other types of tables. But it will 
presently be shown that the supposed increase in security is more illusory than real. 

k. The foregoing facts concerning the various types of quadricular tables generated by diverse 
methods of using sliding primary components or their equivalent rotating cipher disks will be 
employed to good advantage, when the studies presently to be undertaken will bring the student 
to the place where he can comprehend them in the analysis of polyalphabetic systems. But in 
order not to confuse him with a multiplicity of details which have no direct bearing upon basic 
principles, one and only one standard method of finding equivalents by means of sliding compo- 
nents will be selected from among the twelve available, as set forth in the preceding subpara- 
graphs. Unless otherwise stated, this method will be the one denoted by the first of the formulae 
listed in subpar. /, viz: 

0k/8=01/lJ 9p/l = 9o/2 

Calling the plain component “1” and the cipher component "2”, this will mean that the keyletter 
on the cipher component will be set opposite the index, which will be the first letter of the plain 
component; the plain- text letter to be enciphered will then be sought on the plain component and 
its equivalent will be the letter opposite it on the cipher component. 



j I 

i ; 



! I 




I 
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THEORY OF SOLUTION OF REPEATING-KEY SYSTEMS 

Paragraph 



The three steps in the analysis of repeating-key systems 8 

First step: finding the length of the period. 9 

General remarks on factoring 10 

Second step: distributing the cipher text into the component monoalphabets 11 

Third step: solving the monoalphabetic distributions 12 



8. The three steps in the analysis of repeating-key systems. — a. The method of enciphering 
according to the principle of the repeating key, or repeating alphabets is adequately explained in 
Section XI of Elementary Military Cryptography, and no further reference need be made at this 
time. The analysis of a cryptogram of this type, regardless of the kind of cipher alphabets 
employed, or their method of production, resolves itself into three distinct and successive steps. 

(1) Determination of the length of the repeating key, which is the same as the determination 
of the exact number of alphabets involved in the cryptogram; 

(2) Allocation or distribution of the letters of the cipher text into the respective cipher alpha- 
bets to which they belong. This is the step which reduces the polyalphabetic text to mono- 
alphabetic terms; 

(3) Analysis of the individual monoalphabetic distributions to determine plain-text values of 
the cipher letters in each distribution or alphabet. 

b. The foregoing steps will be treated in the order in which mentioned. The first step may 
be described briefly as that of determining the period. The second step may be described briefly 
as that of reduction to monoalphabetic terms. The third step may be designated as identification of 
cipher-text values. 

9. First step: finding the length of the period. — o. The determination of the period, that 
is, the length of the key or the number of cipher alphabets involved in a cryptogram enciphered 
by the repeating-key method is, as a rule, a relatively simple matter. The cryptogram itself 
usually manifests externally certain phenomena which are the direct result of the use of a repeat- 
ing key. The principles involved are, however, so fundamental in cryptanalysis that their 
elucidation warrants a somewhat detailed treatment. This will be done in connection with a 
short example of encipherment, shown in Fig. 1. 

Message 

THE ARTILLERY BATTALION MARCHING IN THE REAR OF THE ADVANCE GUARD KEEPS 
ITS COMBAT TRAIN WITH IT INSOFAR AS PRACTICABLE. 

( 10 ) 
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[Key: BLUE, using direct standard alphabets] 
Cipher Alphabets 



Plain... 




ABCDEFGHIJKLMNOPQRSTUVWXYZ 




(1) .. 


BCDEFGHIJKLMNOPQRSTUVWXYZA 


Cipher 


(2)— 


LMNOPQRSTUVffXYZABCDEFGHIJK 


(3).... 


UVWXYZABCDEFGHIJKLMNOPQRST 




(4).~ 


EFGHIJKLMNOPQRSTUVWXYZABCD 



BLUE 
T H E A 



RTIL 



L E R Y 



B A T T 



ALIO 



N M A R 



CHIN 



G I N T 



HERE 



A R 0 F 



T H E A 



D V A N 



C E G U 



BLUE 
A R D K 



E E P S 



I T S C 



0 M B A 



T T R A 



I N W I 



T H I T 



I N S 0 



F A R A 



S P R A 



C T I C 



ABLE 



BLUE 
T H E A 
U S Y E 



R T 
S E 

L E 
M P 

B A 
C L 

A L 
B W 

N II A 
0 X u 

CHI 

DSC 

GIN 



I L 
C P 

R Y 
L C 

T T 
N X 

I 0 

c s 

R 
V 

N 
R 

T 



H T H X 



HER 
I P L 

A R 0 
B C I 

THE 
U S Y 

D V A N 
E G U R 

C E G U 
D P A Y 



E 

I 

F 

J 

A 

E 



BLUE 
A R D K 
B C X 0 

E P 
P J 

T S 
E M 

M B 
X V 



E 

F 

I 

J 

0 

P 



T 

U 

I 

J 



T H 
U S 



I N S 0 
J Y M S 

F A R A 
G L L E 

S P R A 
TALE 

C T I C 
D E C G 

ABLE 

BHFI 



a 




a 


b 




b 






Cryptogram 






U S Y E S 


ECPUP 


L C C L N 


XBRCS 


0 X U V D 


S C R H T 


H X I P L 


I B C I J 


U S Y E E 


G U R D P 


A Y B C X 


0 F P J W 


J E M G P 


X V E U E 


L E J Y Q 


HUSCX 


J Y 11 S G 


L L E T A 


L E D E C 


GBUFI 











FIQCES L 
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b. Regardless of what System is used, identical plain-text letters enciphered by the same 
cipher alphabet 1 must yield identical cipher letters. Referring to Fig. 1, such a condition is 
brought about every time that identical plain-text letters happen to be enciphered with the same 
key-letter, or every time identical plain-text letters fall into the same column in the encipher- 
ment. 2 Now since the number of columns or positions with respect to the key is very limited 
(except in the case of very long key words), and since the repetition of letters is an inevitable 
condition in plain text, it follows that there will be in a message of fair length many cases where 
identical plain-text letters must fall into the same column. They will thus be enciphered by the 
same cipher alphabet, resulting, therefore, in the production of many identical letters in the 
cipher text and these will represent identical letters in the plain text. When identical plain-text 
polygraphs fall into identical columns the result is the formation of identical cipher-text poly- 
graphs, that is, repetitions of groups of 2, 3, 4, . . . letters are exhibited in the cryptogram. 
Repetitions of this type will hereafter be called causal repetitions, because they are produced by 
a definite, traceable cause, viz, the encipherment of identical letters by the same cipher alphabets. 

c. It will also happen, however, that different plain-text letters falling in different columns 
will, by mere accident, produce identical cipher letters. Note, for example, in Fig. 1 that in 
Column 1, R p becomes S„ and that in Column 2, H p also becomes S„. The production of an identical 
cipher text letter in these two cases (that is, a repetition where the plain-text letters are different 
and enciphered by different alphabets) is merely fortuitous. It is, in every day language, “a 
mere coincidence”, or “an accident.” For this reason repetitions of this type will hereafter be 
called accidental repetitions. 

d. A consideration of the phenomenon pointed out m c makes it obvious that in polyalpha- 
betic ciphers it is important that the cryptanalyst be able to tell whether the repetitions he finds 
in a specific case are causal or accidental in their origin, that is, whether they represent actual 
encipherments of identical plain-text letters by identical keying elements, or mere coincidences 
brought about purely fortuitously. 

e. Now accidental repetitions will, of course, happen fairly frequently with individual letters, 
but less frequently with digraphs, because in this case the same kind of an “accident” must take 
place twice in succession. Intuitively one feels that the chances that such a purely fortuitous 
coincidence will happen two times in succession must be much less than that it will happen every 
once in a while in the case of single letters. Similarly, intuition makes one feel that the chances 
of such accidents happening in the case of three or more consecutive letters are still less than in 
the case of digraphs, decreasing very rapidly as the repetition increases in length. 

j. The phenomena of cryptographic repetition may, fortunately, be dealt with statistically, 
thus taking the matter outside the realm of intuition and putting it on a firm mathematical or 
objective basis. Moreover, often the statistical analysis will tell the cryptanalyst when he has 
arranged or rearranged his text properly, that is, when he is approaching or has reached mono- 
alphabeticity in his efforts to reduce polyalphabetic text to its simplest terms. However, in 
order to preserve continuity of thought it is deemed inadvisable to inject these statistical con- 
siderations at this place in the text proper; they have been incorporated in Appendix 2 hereof. 
The student is advised to study the Appendix very carefully after he has finished reading this 
section of the text. • 

g. At this point it will merely be indicated that if a cryptanalyst were to have at hand only 
the cryptogram of Fig. 1, with the repetitions underlined as below, a statistical study of the 

1 It is to be understood, of course, that cipher alphabets with single equivalents are meant in this case. 

1 The frequency with which this condition may be expected to occur can be definitely calculated. ; A dis- 
cussion of this point falls beyond the scope of the present text. 



REF ID:A64565 



13 



number and length of the repetitions within the message (Par. 5 of Appendix 2) would tell him 
that while some of the digraphic repetitions may be accidental, the chances that they all are 
accidental are small. In the case of the tetragraphic repetition he would realize that the 
chances of its being accidental are very small indeed. 



A. 


U S Y E S 


E C P M P 


L C C L N 


X B W C S 


0 X U V D 


B. 


S C R H T 


H X I P L 


I B C I J 


U S Y E E 


GURDP ■ 


C. 


A Y B C X 


0 F P J W 


JEMGP 


X V E U E 


L E J Y Q 


D. 


M U SCX 


J Y M S G 


L L E T A 


L E D E_C 


GBUFI 


h. A consideration of the facts therefore leads to but 


one conclusion, vis, that the repetitions 



exhibited by the cryptogram under investigation are not accidental but are causal in their origin; 
and the cause is in this case not difficult to find: repetitions in the plain text were actually en- 
ciphered by identical alphabets. In order for this to occur, it was necessary that the tetragraph 
USYE, for example, fall both times in exactly the same relative position with respect to the key. 
Note, for example, that UYSE in Fig. 1 represents in both cases the plain-text polygraph THEA. 
The first time it occurred it fell in positions 1-2-3-4 with respect to the key; the second time it 
occurred it happened to fall in the very same relative positions, although it might just as well 
have happened to fall in any of the other three possible relative positions with respect to the 
key, viz, 2-3-4-1, 3-4-1-2, or 4-1-2-3. 

i. Lest the student be misled, however, a few more words are necessaiy on this subject. 
In the preceding subparagraph the word “happened” was used; this word correctly expresses 
the idea in mind, because the insertion or deletion of a single plain-text letter between the two 
occurrences would have thrown the second occurrence one letter forward or backward, respec- 
tively, and thus caused the polygraph to be enciphered by a sequence of alphabets such as can 
no longer produce the cipher polygraph USYE from the plain-text polygraph THEA. On the 
other hand, the insertion or deletion of this one letter might bring the letters of some other 
polygraph into similar columns so that some other repetition would be exhibited in case the 
USYE repetition had thus been suppressed. 

j. The encipherment of similar letters by similar cipher alphabets is therefore the cause of 
the production of repetitions in the cipher text in the case of repeating-key ciphers. What 
principles can be derived from this fact, and how can they be employed in the solution of crypto- 
grams of this type? 

k. If a count is made of the number of letters from and including the first USYE to, but not 
including, the second occurrence of USYE, a total of 40 letters is found to intervene between the 
two occurrences. This number, 40, must, of course, be an exact multiple of the length of the key. 
Having the plain-text before one, it is easily seen that it is the 10th multiple; that is, the 4-letter 
key has repeated itself 10 times between the first and the second occurrence of USYE. It follows, 
therefore, that if the length of the key were not known, the number 40 could safely be taken to 
be an exact multiple of the length of the key ; in other words, one of the factors of the number 
40 would be equal to the length of the key. The word “safely” is used in the preceding sentence 
to mean that the interval 40 applies to a repetition of 4 letters and it has been shown that the 
chances that this repetition is accidental are small. The factors of 40 are 2, 4, 5, 8, 10, and 20. 
So far as this single repetition of USYE is concerned, if the length of the key were not known, all 
that could be said about the latter would be that it is equal to one of these factors. The repeti- 
tion by itself gives no further indications. How can the exact factor be selected from among a 
list of several possible factors? 



152018—88 2 
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l. Let the intervals between all the repetitions in the cryptogram be listed. They are as 
follows: 



Repetition 


Interval 


factors 


1st USYE to 2d USYE 


40 


2, 4, 5, 8, 10, 20. 
2, 4, 8. 


1st BC tn 2d BC 


16 


1st CX tn 2d CX 


25 


6 . 


1st Flfl tn 2d Fin 


88 


2, 4, 11, 22, 44. 


1st LE tn 2d LE 


16 


2, 4, 8. 


2d I.E tn 3rt LE 


4 


2’ 4. 


1st LE to 3d LE 


20 


2, 4, 5, 10. 


1st, JY tn 2d JY. .... 


8 


2, 4. 


1st PL to 2d PL 


24 


2, 3, 4, 6, 8, 10, 12. 
2, 4, 13, 26. 

2, 3, 4, 6, 9, 18. 


1st Sn tn 2d SC 


52 


(1st SY to 2d SY, already included in USYE.) 

(1st US to 2d US, already included in USYE.) 

2d US to 3d US 


36 


(1st US to 3d US, already included in USYE.) 
(1st YE to 2d YE, already included in USYE.) 



m. Are all these repetitions causal repetitions? It can be shown (Appendix 2, par. 4c) that 
the odds against a theory that the UYSE repetition is accidental are about 99 to 1 (since the 
probability for its occurrence is .01). It can also be shown that the odds against a theory that the 
10 digraphs which occur two or more times are accidental repetitions are over 4 to 1 (Appendix 
2, par. 5c); the odds against a theory that the two digraphs which occur 3 times are accidental 
repetitions are quite large. (Probability is calculated to be about .06.) The chances are very 
great, therefore, that all or nearly all these repetitions are causal. Certainly the chances against 
the two occurrences of the tetragraph UYSE and the three occurrences of the two different digraphs 
(LE and US) being accidental are quite high, and it is therefore not astonishing that the intervals 
between all the various repetitions, except in one case, contain the factors 2 and 4. 

n. This means that if the cipher is written out in either 2 columns or 4 columns, all these 
repetitions (except the CX repetition) would fall into the same columns. From this it follows 
that the length of the key is either 2 or 4, the latter, on practical grounds, being more probable 
than the former. Doubts concerning the matter of choosing between a 2-letter and a 4-letter 
key will be dissolved when the cipher text is distributed into its component uniliteral frequency 
distributions. 

o. The repeated digraph CX in the foregoing message is an accidental repetition, as will be 
apparent by referring to Fig. 1. Had the message been longer there would have been more 
such accidental repetitions, but, on the other hand, there would be a proportionately greater 
number of causal repetitions. This is because the phenomenon of repetition in plain text is 
so all-pervading. 

p. Sometimes it happens that the cryptanalyst quickly notes a repetition of a polygraph of 
four or more letters, the interval between the first and second occurrences of which has only 
two factors, of which one is a relatively small number, the other a relatively high incommen- 
surable number. He may therefore assume at once that the length of the key is equal to the 
smaller factor without searching for additional recurrences upon which to corroborate his 
assumption. Suppose, for example, that in a relatively short cryptogram the interval between 
the first and second occurrences of a polygraph of five letters happens to be a number such as 
203, the factors of which are 7 and 29. Evidently the number of alphabets may at once be 










REF ID:A64565 



Hi 

i 1 



assumed to be 7, unless one is dealing with messages exchanged among correspondents known 
to use long keys. In the latter case one could assume the number of alphabets to be 29. 

q. The foregoing method of determining the period in a polyalphabetic cipher is commonly 
referred to the literature as “factoring the intervals between repetitions”; or more often it is 
simply called “factoring.” Because the latter is an apt term and is brief, it will be employed 
hereafter in this text to designate the process. 

10. General remarks on factoring. — a. The statement made in Par. 2 with respect to the 
cyclic phenomena said to be exhibited in cryptograms of the periodic type now becomes clear. 
The use of a short repeating key produces a periodicity of recurrences or repetitions collectively 
termed “cyclic phenomena”, an analysis of which leads to a determination of the length of the 
period or cycle, and this gives the length of the key. Only in the case of relatively short crypto- 
grams enciphered by a relatively long key does factoring fail to lead to the correct determination 
of the number of cipher alphabets in a repeating-key cipher; and of course, the fact that a crypto- 
gram contains repetitions whose factors show constancy is in itself an indication and test of its 
periodic nature. It also follows that if the cryptogram is not a repeating-key cipher, then 
factoring will show no definite results, and conversely the fact that it does not yield definite 
results at once indicates that the cryptogram is not a periodic, repeating-key cipher. 

b. There are two cases in which factoring leads to no definite results. One is in the case of 
monoalphabetic substitution ciphers. Here recurrences are very plentiful as a rule, and the 
intervals separating these recurrences may be factored, but the factors will show no constancy; 
there will be several factors common to many or most of the recurrences. This in itself is an 
indication of a monoalphabetic substitution cipher, if the very fact of the presence of many 
recurrences fails to impress itself upon the inexperienced cryptanalyst. The other case in which 
the process of factoring is nonsignificant involves certain types of nonperiodic, polyalphabetic 
ciphers. In certain of these ciphers recurrences of digraphs, trigraphs, and even polygraphs 
may be plentiful in a long message, but the intervals between such recurrences bear no definite 
multiple relation to the length of the key, such as in the case of the true periodic, repeating-key 
cipher, in which the alphabets change with successive letters and repeat themselves over and 
over again. 

c. Factoring is not the only method of determining the length of the period of a periodic, 
polyalphabetic substitution cipher, although it is by far the most common and easily applied. 
At this point it will merely be stated that when the message under study is relatively short in 
comparison with the length of the key, so that there are only a few cycles of cipher text and no 
long repetitions affording a basis for factoring, there are several other methods available. 
However, it being deemed inadvisable to interject the data concerning those other methods 
at this point, they will be explained subsequently. It is desirable at this juncture merely to 
indicate that methods other than factoring do exist and are used in practical work. 

d. Fundamentally, the factoring process is merely a more or less simple mathematical method 
of studying the phenomena of periodicity in cryptograms. It will usually enable the crypt- 
analyst to ascertain definitely whether or not a given cryptogram is periodic in nature, and if 
so, the length of the period, stated in terms of the cryptographic unit involved. By the latter 
statement is meant that the factoring process may be applied not only in analyzing the periodicity 
manifested by cryptograms in which the plain-text units subjected to cryptographic treatment 
are monographic in nature (i. e. are single letters) but also in studying the periodicity exhibited 
by those occasional cryptograms wherein the plain-text units are digraphic, trigraphic, or 
ft-graphic in character. The student should bear this point in mind when he comes to the study 
of substitution systems of the latter sort. However, the present text will deal solely with cases 
of the former type, wherein the plain-text units subjected to cryptographic treatment are single 

i | letters. 

1 ! 
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11. Second step: distributing the cipher text into the component monoalphabets. — a. 
After the number of cipher alphabets involved in the cryptogram has been ascertained, the next 
step is to rewrite the message in groups corresponding to the length of the key, or in columnar 
fashion, whichever is more convenient, and this automatically divides up the text so that the 
letters belonging to the same cipher alphabet occupy similar positions in the groups, or, if the 
columnar method is used, fall in the same column. The letters are thus allocated or distributed 
into the respective cipher alphabets to which they belong. This reduces the polyalphabetic 
text to monoalphabetic terms. 

b. Then separate uniliteral frequency distributions for the thus isolated individual alphabets 
are compiled. For example, in the case of the cipher on page 13, having determined that four 
alphabets are involved, and having rewritten the message in four columns, a frequency distribu- 
tion is made of the letters in Column 1, another is made of the letters in Column 2, and so on for 
the rest of the columns. Each of the resulting distributions is therefore a monoalphabetic frequency 
distribution. If these distributions do not give the characteristic irregular crest and trough 
appearance of monoalphabetic frequency distributions, then the analysis which led to the 
hypothesis as regards the number of alphabets involved is fallacious. In fact, the appearance of 
these individual distributions may be considered to be an index of the correctness of the factoring 
process; for theoretically, and practically, the individual distributions constructed upon the 
correct hypothesis will tend to conform more closely to the irregular crest and trough appearacne 
of a monoalphabetic frequency distribution than will the graphic tables constructed upon an 
incorrect hypothesis. These individual distributions may also be tested for monoalphabeticity 
by statistical methods. 

12. Third step: solving the monoalphabetic distributions. — The difficulty experienced in 
analyzing the individual or isolated frequency distributions depends mostly upon the type of 
cipher alphabets that is used. It is apparent that mixed alphabets may be used just as easily as 
standard alphabets, and, of course, the cipher letters themselves give no indication as to which 
is the case. However, j ust as it was found that in the case of monoalphabetic substitution ciphers, 
a uniliteral frequency distribution gives clear indications as to whether the cipher alphabet is a 
standard or a mixed alphabet, by the relative positions and extensions of the crests and troughs 
in the table, so it is found that in the case of repeating-key ciphers, uniliteral frequency distribu- 
tions for the isolated or individual alphabets will also give clear indications as to whether these 
alphabets are standard alphabets or mixed alphabets. Only one or two such frequency distribu- 
tions are necessary for this determination ; if they appear to be standard alphabets, similar distri- 
butions can be made for the rest of the alphabets; but if they appear to be mixed alphabets, then 
it is best to compile triliteral frequency distributions for all the alphabets. The analysis of the 
values of the cipher letters in each table proceeds along the same lines as in the case of monoalpha- 
betic ciphers. The analysis is more difficult only because of the reduced size of the tables, but 
if the message be very long, then each frequency distribution will contain a sufficient number of 
elements to enable a speedy solution to be achieved. 
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Section IV 

REPEATING-KEY SYSTEMS WITH STANDARD CIPHER ALPHABETS 

Paragraph 



Solution by applying principles of frequency 13 

Solution by completing the plain-component sequence 14 

Solution by the “probable-word method” 15 



13. Solution by applying principles of frequency. — a. In the light of the foregoing principles, 
let the following cryptogram be studied: 

Message 

1 2 3 4 8 



A. 


A 


U K 


_H Y 


J A M K I 


Z 


Y. 


J W 


M 


J 


M 


1 G X 


N F_M 


L 


X 


B. 


E 


T I 


M 


I 


Z H B H R 


A 


Y 


J z 


M 


I 


L 


V M E 


J 


K U 


T 


G 


C. 


D 


P V. 


J 


K 


Q U K H Q 


L 


H V R 


M 


J_ 


_A 


Z N G 


G 


z v_x 


E 


D. 


N 


L U 


_F_ 


M 


P Z J N V 


C 


H 


U A_ 


J 


H 


K 


Q G K 


I 


P L 


W 


P 


E. 


A 


J Z 


_X_ 


I 


G U M T V 


D 


P. 


T E 


_J 


E 


C 


MYS 


Q 


Y B 


A 


V 


F. 


A 


L A 


H 


Y 


P 0 E X W 


P 


V 


N Y 


E 


E 


Y 


X E E 


u 


D P 


X 


R 


G. 


B 


V Z 


V 


I 


Z I I V 0 


S 


P_ 


T E 


G 


K 


U 


B B R 


Q 


L L 


X 


P 


H. 


W 


FOG 


K 


N L L L E 


P 


T 


I K 


W 


D 


J_ 


Z X I 


G 


0 I 


0 


I 


J. 


Z. 


L A 


M V 


K F_M W F 


N 


P 


L Z 


I 


0 


V 


V F M 


Z 


K T 


X 


G 


K. 


N_ 


L M 


D 


F 


A A E X I 


J 


L_ 


U F M 


P 


z_ 


J N V 


C 


A I 


G 


I 


L. 


U 


A W 


P 


R 


N V I W E_ 


J 


_K 


Z A_ 


J 


Z. 


L_ 


_A E_M 


H 


S 







A search for repetitions discloses the following short list with the intervals and factors 
above 10 omitted (for previous experience may lead to the conclusion that it is unlikely that the 
cryptogram involves more than 10 alphabets, showing the number of recurrences which it does): 



Repetition 


Location 


Interval 


Factors 


LUFMPZJNVC 


Dl, K3 


160 


2, 4, 5, 8, 10. 


JZXIG- 


El, H4 


90 


2. 3, 5, 6, 9, 10. 


EJK 


B4, L2 


215 


5. 


PTE 


E3, G3 


60 


2, 5, 10. 


QGK___ 


D4, HI 


85 


5. 


UKH 


Al, C2 


55 


5. 


ZLA._ 


Jl, L4 


65 


5. 


AS 


D3, L3 


175 


3, 5, 7, 


EJ.. 


B4, L2 


115 


5. 


FM 


A5, Dl 


57 


3. 


FM 


A5, J2 


185 


5. 


FM 


J2, J4 


12 


2, 3, 4, 6. 


FM _ ... 


J4, K3 


20 


2, 4, 5, 10. 


FM. 


K3, L4 


30 


2, 3, 5, 6, 10. 


JA... 


A2, C4 


60 


2, 3, 4, 5, 6, 10. 


LA 


FI, Jl 


75 


3, 5. 


LA ... 


Jl, L4 


65 


5. 


LL . _ 


G5, H2 


10 


2, 5. 


NL 


Dl, H2 


105 


3, 5, 7. 


NL _ 


H2, K1 


45 


3, 5, 9. 


VX. 


Cl, C5 


20 


2, 4, 5, 10. 


YM. 


A3, B3 


25 


5. 



( 17 ) 
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b. The factor 5 appears in all but two cases, each of which involves only a digraph. It seems 
almost certain that the number of alphabets is five. Since the text already appears in groups of 
five letters, it is unnecessary to rewrite the message. The next step is to make a uniliteral fre- 
quency distribution for Alphabet 1 to see if it can be determined whether or not standard alpha- 
bets are involved. It is as follows: 

Alphabet 1 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 



c. Although the indications are not very clear cut, yet if one takes into consideration the 
small amount of data the assumption of a direct standard alphabet with W C =A P , is worth further 
test. Accordingly a similar distribution is made for Alphabet 2. 



Alphabet 2 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 



d. There is every indication of a direct standard alphabet, with H C =A P . Let similar distri- 
butions be made for the last three alphabets. They are as follows: 



Alphabet 3 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 



Alphabet 4 




ABCDEFGHIJKLMNOPQRSTUVWXYZ 



Alphabet 5 

abcdSfghijklmnopqrstuvwxyz 

e. After but little experiment it is found that the distributions can best be made to fit 
the normal when the following values are assumed: 



Alphabet 1 


— A p — W 


Alphabet 2 


.... A P =H 


Alphabet 3 


.... A P =I 


Alphabet 4 


.... A P =T 


Alphabet 5 


.... A P =E 



/. Note the key word given by the successive equivalents of A„: WHITE. The real proof of 
the correctness of the analysis is, of course, to test the values of the solved alphabets on the 
cryptogram. The five complete cipher alphabets are as follows: 



Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

'l WXYZABCDEFGHIJKLMNOPQRSTUV 

2 HIJKLMNOPQRSTUVWXYZABCDEFG 

Ciphers 3 IJKLMNOPQRSTUVWXYZABCDEFGH 

4 TUVWXYZABCDEFGHIJKLMNOPQRS 

5 — EFGH.I J K L M N 0 P Q R S T U V W X Y Z A B C D 

Fiqubi 2. 
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g. Applying these values to the first few groups of our message, the following is found: 

12 3 4 5 1 2345 12345 12345 12345 

Cipher AUKHY JAMKI ZYMWM JMIGX NFMLX... 

Plain ENCOU NTERE DREDI NFANT RYEST . . . 

h. Intelligible text at once results, and the solution can now be completed very quickly. 
The complete message is as follows: 

ENCOUNTERED RED INFANTRY ESTIMATED AT ONE REGIMENT AND MACHINE GUN COM- 
PANY IN TRUCKS NEAR EMMITSBURG. AM HOLDING MIDDLE CREEK NEAR HILL 543 SOUTH- 
WEST OF FAIRPLAY. WHEN FORCED BACK WILL CONTINUE DELAYING REDS AT MARSH 
CREEK. HAVE DESTROYED BRIDGES ON MIDDLE CREEK BETWEEN EMMITSBURG-TANEYTOWN 
ROAD AND RHODES MILL. 

i. In the foregoing example (which is typical of the system erroneously attributed, in cryp- 
tographic literature, to the French cryptographer Vigen&re, although to do him justice, he 
made no claim of having “invented” it), direct standard alphabets were used, but it is obvious 
that reversed standard alphabets may be used and the solution accomplished in the same 
manner. In fact, the now obsolete cipher disk used by the United States Army for a number 
of years yields exactly this type of cipher, which is also known in the literature as the Beaufort 
Cipher, and by other names. In fitting the isolated frequency distributions to the normal, the 
direction of “reading” the crests and troughs is merely reversed. 

14. Solution by completing the plain-component sequence. — a. There is another method 
of solving this type of cipher, which is worthwhile explaining, because the underlying principles 
will be found useful in many cases. It is a modification of the method of solution by completing 
the plain-component sequence, already explained in Military Cryptanalysis, Part I. 

b. After all, the individual alphabets of a cipher such as the one just solved are merely 
direct standard alphabets. It has been seen that monoalphabetic ciphers in which standard 
cipher alphabets are employed may be solved almost mechanically by completing the plain- 
component sequence. The plain text reappears on only one generatrix and this generatrix iB the 
same for the whole message. It is easy to pick this generatrix out of all the other generatrices 
because it is the only one which yields intelligible text. Is it not apparent that if the same process 
is applied to the cipher letters of the individual alphabets of the cipher just solved that the plain- 
text equivalents of these letters must all reappear on one and the same generatrix? But how 
will the generatrix which actually contains the plain-text letters be distinguishable from the 
other generatrices, since these plain-text letters are not consecutive letters in the plain text but 
only letters separated from one another by a constant interval? The answer is simple. The plain- 
text generatrix should be distinguishable from the others because it will show more and a better 
assortment of high-frequency letters, and can thus be selected by the eye from the whole set of genera- 
trices. If this is done with all the alphabets in the cryptogram, it will merely be necessary to 
assemble the letters of the thus selected generatrices in proper order, and the result sould be 
consecutive letters forming intelligible text. 

c. An example will serve to make the process clear. Let the same message be used as before. 
Factoring showed that it involves five alphabets. Let the first ten cipher letters in each alphabet 
be set down in a horizontal line and let the normal alphabet sequences be completed. Thus: 
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Alphabet 1 


Alphabet 2 


Alphabet 3 


Alphabet 4 


Alphabet 1 


1 


AJZJNEZAIJ 


UAYMFTHYLK 


KMMIMIBMVU 


HKWGLMHZMT 


YIMXXIRMEG 


2 


BKAKOFABJK 


VBZNGUIZML 


LNNJNJ CNWV 


ILXHMNIANU 


ZJNYYJSNFH 


3 


CLBLPGBCKL 


WCAOHVJANM 


M00K0KD9XW 


JMYINOJBOV 


AKOZZKTOGI 


4 


DMGMQHCDLM 


XDBPIWKBON 


NPPLPLEPYX 


KNZJOPKCPW 


BLPAALUPHJ 


5 


ENDNRIDEMN 


YECQJXLCPO 


OQQMQMFQZY 


LOAKPQLDQX 


CMQBBMVQIK 


6 


FOEOSJEFNO 


ZFDRKYMDQP 


PRRNRNGRAZ 


MPBLQRMERY 


DNRCCNWRJL 


7 


GPFPTKFGOP 


AGESLZNERQ 


QSSOSOHSBA 


NQCMRSNFSZ 


EOSDDOXSKM 


8 


HQGQULGHPQ 


BHFTMAOFSR 


RTTPTPITCB 


ORDNSTOGTA 


FPTEEPYTLN 


9 


IRHRVMHIQR 


CIGUNBPGTS 


SUUQUQJUDC 


PSEOTUPHUB 


GQUFFQZUMO 


10 


JSISWNIJRS 


DJHVOCQHUT 


TWRVRKVED 


QTFPUVQIVC 


HRVGGRAVNP 


1.1 


KTJTXOJKST 


EKIWPDRIVU 


UWWSWSLWFE 


RUGQVWRJWD 


ISWHHSBWOQ 


12 


LUKUYPKLTU 


FLJXQESJWV 


VXXTXTMXGF 


SVHRWXSKXE 


JTXIITCXPR 


13 


MVLVZQLMUV 


GMKYRFTKXW 


WYYUYUNYHG 


TWISXYTLYF 


KUYJJUDYQS 


14 


NWMWARMNVW 


HNLZSGULYX 


XZZVZVOZIH 


UXJTYZUMZG 


LVZKKVEZRT 


15 


0XNXBSN0WX 


IOMATHVMZY 


YAAWAWPAJI 


VYKUZAVNAH 


MWALLWFASU 


16 


PYOYCTOPXY 


JPNBUIWNAZ 


ZBBXBXQBKJ 


WZLVABWOBlv 


NXBMMXGBTV 


17 


QZPZDUPQYZ 


KQOCVJXOBA 


ACCYCYRCLK 


XAMWBCXPCJ > 


V OYCNNYHCUW 


18 


RAQAEVQRZA 


LRPDWKYPCB 


BDDZDZSDML 


YBNXCDYQDK 


\ZD00ZIDVX 


19 


SBRBFWRSAB 


MSQEXLZQDC 


CEEAEATENM 


ZCOYDEZREL 


QAEPPAJEWY 


20 


TCSCGXSTBC 


NTRFYMARED 


DFFBFBUFON 


ADPZEFASFM 


RBFQQBKFXZ 


21 


UDTDHYTUCD 


OUSGZNBSFE 


EGGCGCVGPO 


BEQAFGBTGN 


SCGRRCLGYA 


22 


VEUEIZUVDE 


PVTHAOCTGF 


FHHDHDWHQP 


CFRCGHCUHO 


TDHSSDMHZB 


23 


WFVFJAVWEF 


QWUIBPDUHG 


GIIEIEXIRQ 


DGSCHIDVIP 


UEITTENIAC 


24 


XGWGKBWXFG 


RXVJCQEVIH 


HJJFJFYJSR 


EHTDIJEWJQ 


VFJUUFOJBD 


25 


YHXHLCXYGH 


SYWKDRFWJI 


IKKGKGZKTS 


FIUEJKFXKR 


WGKWGPKCE 


26 


ZIYIMDYZHI 


TZXLESGXKJ 


JLLHLHALUT 


GJVFKLGYLS 


XHLWWHQLDF 



Figube 3. 



d. If the high-frequency generatrices underlined in Figure 3 are selected and their letters 
are juxtaposed in columns the consecutive letters of intelligible plain text immediately present 



themselves. Thus: 

For Alphabet 1, generatrix 5_. ENDNRIDEMN 

For Alphabet 2, generatrix 20 NTRFYMARED 

Selected Generatrices' For Alphabet 3, generatrix 19 CEEAEATENM 

For Alphabet 4, generatrix 8 ORDNSTOGTA 

For Alphabet 5, generatrix 23 UEITTENIAC 



Columnar juxtaposition of letters 
from selected generatrices 



1 2 3 4 5 
E N C 0 D 
N T E R E 
D R E D I 
N F A N T 
R Y E S T 
' I M A T E 
D A T 0 N 
E R E G I 
M E N T A 
N D M A C 



Figure 4. 
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Plain text: ENCOUNTERED RED INFANTRY ESTIMATED AT ONE 
REGIMENT AND MAC ... . 

e. Solution by this method can thuB be achieved without the compilation of any frequency 
tables whatever and is very quickly attained. The inexperienced cryptanalyst may have diffi- 
culty at first in selecting the generatrices which contain the most and the best assortment of 
high-frequency letters, but with increased practice, a high degree of proficiency is attained. 
After all it is only a matter of experiment, trial, and error to select and assemble the proper 
generatrices so as to produce intelligible text. 

j. If the letters on the sliding strips were accompanied by numbers representing their relative 
frequencies in plain text, and these numbers were added across each generatrix, then that gen- 
eratrix with the highest total frequency would theoretically always be the plain-text generatrix. 
Practically it will be among the generatrices which show the first three or four greatest totals. 
Thus, an entirely mathematical solution for this type of cipher may be applied. 

g. If the cipher alphabets are reversed standard alphabets, it is only necessary to convert 
the cipher letters of each isolated alphabet into their normal, plain-component equivalents and 
then proceed as in the case of direct standard alphabets. 

h. It has been seen how the key word may be discovered in this type of cryptogram. Usually 
the key is made up of those letters in the successive alphabets whose equivalents are A p but other 
conventions are of course possible. Sometimes a key number is used, such as 8-4-7-1-12, 
which means merely that A p is represented by the eighth letter from A (in the normal alphabet) 
in the first cipher alphabet, by the fourth letter from A in the second cipher alphabet, and so on. 
This modification is known in the literature as the Gronsfeld cipher. However, the method of 
solution as illustrated above, being independent of the nature of the key, is the same as before. 

15. Solution by the “probable-word method.” — a. The common use of key words in cryp- 
tograms such as the foregoing makes possible a method of solution that is simple and can be used 
where the more detailed method of analysis using frequency distributions or by completing the 
plain-component sequence is of no avail. In the case of a very short message which may show 
no recurrences and give no indications as to the number of alphabets involved, this modified 
method will be found most useful. 

b. Briefly, the method consists in assuming the presence of a probable word in the message, 
and referring to the alphabets to find the key letters applicable when this hypothetical word is 
assumed to be present in various positions in the cipher text. If the assumed word happens to 
be correct, and is placed in the correct position in the message, the key letters produced by 
referring to the alphabets will yield the key word. In the following example it is assumed that 
reversed standard alphabets are known to be used by the enemy. 

Message 

MDSTJ LQCXC KZASA NYYKO LP 

c. Extraneous circumstances lead to the assumption of the presence of the word AMMU- 
NITION. One may assume that this word begins the message. Using sliding normal compo- 
nents, one reversed, the other direct, the key letters are ascertained by noting what the successive 
equivalents of A p are. Thus: 



Cipher. MDSTJLQCXC 

Plain text AMMUNITION 

“Key”— MPENWTJKLP 
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The key does not spell any intelligible word. One therefore shifts the assumed word one letter 
forward and another trial is made. 

Cipher DSTJLQCXCK 

Plain text AMMUNITION 

“Key” DEFDYYVFQX 

This also yields no intelligible key word. One continues to shift the assumed word forward 

one space at a time until the following point is reached. 

Cipher LQCXCKZASA 

Plain text AMMUNITION 

“Key” LCORPSSIGN 

The key now becomes evident. It is a cyclic permutation of SIGNAL CORPS. It should be 
clear that since the key word or key phrase repeats itself during the encipherment of such a 
message, the plain-text word upon whose assumed presence in the message this test is being 
based may begin to be enciphered at any point in the key, and continue over into its next repeti- 
tion if it is longer than the key. When this is the case it is merely necessary to shift the latter 
part of the sequence of key letters to the first part, as in the case noted: LCORPSSIGN is trans- 
posed into SIGN . . . LCORPS, and thus SIGNAL CORPS. 

d. It will be seen in the foregoing method of solution that the length of the key is of no 
particular interest or consequence in the steps taken in effecting the solution. The determina- 
tion of the length and elements of the key comes after the solution rather than before it. In this 
case the length of the period is seen to be eleven, corresponding to the length of the key (SIGNAL 
CORPS). 

e. The foregoing method is one of the other methods of determining the length of the key 
(besides factoring), referred to in Par. 10c. 

j. If the assumption of reversed standard alphabets yields no good results, then direct 
standard alphabets are assumed and the test made exactly in the same manner. As will be 
shown subsequently, the method can also be used as a last resort when mixed alphabets are 
employed. 

g. When the assumed word is longer than the key, the sequence of recovered key letters will 
show a periodicity equal to the length of the key; that is, after a certain number of letters the 
sequence of key letters will repeat. This phenomenon would be most useful in the case of keys 
that are not intelligible words but are composed of random letters or figures. Of course, if such 
a key is longer than the assumed word, this method is of no avail. 

h. This method of solution by searching for a word is contingent upon the following cir- 
cumstances: 

(1) That the word whose presence is assumed actually occurs in the message, is properly 
spelled, and correctly enciphered. 

(2) That the sliding components (or equivalent cipher disks or squares) employed in the 
search for the assumed word are actually the ones which were employed in the encipherment, 
or are such as to give identical results as the ones which were actually used. 

(3) That the pair of enciphering equations used in the test is actually the pair which was 
employed in the encipherment; or if a cipher square is used in the test, the method of finding 
equivalents gives results that correspond with those actually obtained in the encipherment. 
(See par. 9.) 
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i. The foregoing appears to be quite an array of contingencies and the student may think 
that on this account the method will often fail. But examining these contingencies one by one, 
it will be seen that successful application of the method may not be at all rare — after the solution 
of some messages has disclosed what sort of paraphernalia and methods of employing them are 
favored by the enemy. From the foregoing remark it is to be inferred that the probable-word 
method has its greatest usefulness not in an initial solution of a system, but only after successful 
study of enemy communications by more difficult processes of analysis has told its story to the 
alert cryptanalyst. Although it is commonly attributed to Bazeries, the French cryptanalyst 
of 1900, the probable-word method is very old in cryptanalysis and goes back several centuries. 
Its usefulness in practical work may best be indicated by quoting from a competent observer 

There is another [method] which is to this first method what the geometric method is to analysis in certain 
sciences, and, according to the whims of individuals, certain cryptanalysts prefer one to the other. Certain others, 
incapable of getting the answer with one of the methods in the solution of a difficult problem, conquer it by means 
of the other, with a disconcerting masterly stroke. This other method is that of the probable word. We may 
have more or less definite opinions concerning the subject of the cryptogram. We may know something about its 
date, and the correspondents, who may have been indiscreet in the subject they have treated. On this basis, the 
hypothesis is made that a oertain word probably appears in the text. ... In certain classes of documents, 
military or diplomatic telegrams, banking and mining affairs, etc., it is not impossible to make very important 
assumptions about the presence of certain words in the text. After a cryptanalyst has worked for a long time 
with the writings of certain correspondents, he gets used to their expressions. He gets a whole load of words 
to try out; then the changes of key, and sometimes of system, no longer throw into his way the difficulties of an 
absolutely new study, which might require the analytical method. 

1 Givierge, M., Cours de Cryptographic, Paris, 1925, p. 30. 
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REPEATING-KEY SYSTEMS WITH MIXED CIPHER ALPHABETS, I 
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Solution of subsequent messages enciphered by same cipher component 23 

Summation of relative frequencies as an aid to the selection of the correct generatrices ... 24 

Solution by the probable-word method 26 

Solution when plain component is mixed, the oipher component, the normal 26 



16. Season for the use of mixed alphabets. — a. It has been seen in the examples considered 
thus far that the use of several alphabets in the same message does not greatly complicate the 
analysis of such a cryptogram. There are three reasons why this is so. Firstly,* only relatively 
few alphabets were employed; secondly, these alphabets were employed in a periodic or repeating 
manner, giving rise to cyclic phenomena in the cryptogram, by means of which the number of 
alphabets could be determined; and, thirdly, the cipher alphabets were known alphabets, by 
which is meant merely that the sequences of letters in both components of the cipher alphabets 
were known sequences. 

b. In the case of monoalphabetic ciphers it was found that the use of a mixed alphabet 
delayed the solution to a considerable degree, and it will now be seen that the use of mixed alpha- 
bets in polyalphabetic ciphers renders the analysis much more difficult than the use of standard 
alphabets, but the solution is still fairly easy to achieve. 

17. Interrelated mixed alphabets. — a. It was stated in Par. 5 that the method of producing 
the mixed alphabets in a polyalphabetic cipher often affords clues which are of great assistance 
in the analysis of the cipher alphabets. This is so, of course, only when the cipher alphabets 
are interrelated secondary alphabets produced by sliding components or their equivalents. 
Reference is now made to the classification set forth in Par. 6, in connection with the types of 
alphabets which may be employed in polyalphabetic substitution. It will be seen that thus far 
only Cases A (1) and (2) have been treated. Case B (1) will now be discussed. 

b. Here one of the components, the plain component, is the normal sequence, while the 
cipher component is a mixed sequence, the various juxtapositions of the two components yielding 
mixed alphabets. The mixed component may be a systematically-mixed or a random-mixed 
sequence. If the 25 successive displacements of the mixed component are recorded in separate 
lines, a symmetrical cipher square such as that shown in Fig. 5 results therefrom. It is identical 
in form with the square table shown on p. 7, labeled Table I-A. 

(24) 
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ABCDEFGHIJKLMNOPQRSTUVWXYZ 
LEAVNWORTHBCDFGIJKMPQSUXYZ 
EAVNWORTHBCDFGIJKMPQSUXYZL 
AVNWORTHBCDFGIJKMPQSUXYZLE 
VNWORTHBCDFGIJKMPQSUXYZLEA 
NWORTHBCDFGIJKMPQSUXYZLEAV 
WORTHBCDFGIJKMPQSUXYZLEAVN 
ORTHBCDFGIJKMPQSUXYZLEAVNW 
RTHBCDFGIJKMPQSUXYZLEAVNWO 
THBCDFGI JKMPQSUXYZLEAVHIOR 
HBCDFGIJKMPQSUXYZLEAVNWORT 
BCDFGIJKMPQSUXYZLEAVNWORTH 
CDFGI JKMPQSUXYZLEAVNWORTHB 
DFGIJKMPQSUXYZLEAVNWORTHBC 
FGIJKMPQSUXYZLEAVNWORTHBCD 
GIJKMPQSUXYZLEAVNWORTHBCDF 
IJKMPQSUXYZLEAVNWORTHBCDFG 
JKMPQSUXYZLEAVNWORTHBCDFGI 
KMPQSUXYZLEAVNWORTHBCDFGIJ 
MPQSUXYZLEAVNWORTHBCDFGIJK 
PQSUXYZLEAVNWORTHBCDFGIJKM 
QSUXYZLEAVNWORTHBCDFGIJKMP 
SUXYZLEAVNWORTHBCDFGIJKMPQ 
UXYZLEAVNWORTHBCDFGIJKMPQS 
XYZLEAVNWORTHBCDFGIJKMPQSU 
YZLEAVNWORTHBCDFGIJKMPQSUX 
ZLEAVNWORTHBCDFGIJKMPQSUXY 

Figure 5. 

c. Such a cipher square may be used in exactly the same manner as the Vigenfere square. 
With the key word BLUE and conforming to the normal enciphering equations (0 k /a=©i/i; ©p/i= 
© 0 / 2 ). the following lines of the square would be used: 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

BCDFGIJKMPQSUXYZLEAVNWORTH 

LEAVNWORTHBCDFGIJKMPQSUXYZ 

UXYZLEAVNWORTHBCDFGIJKMPQS 

EAVNWORTHBCDFGIJKMPQSUXYZL 

Fiqtjbb 6a. 

These lines would, of course, yield the following cipher alphabets: 

. . Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

{ } Cipher. BCDFGIJKMPQSUXYZLEAVNWORTH 

... Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

1 ‘ Cipher. LEAVNWORTHBCDFGIJKMPQSUXYZ 

... Plain. ABCDEFGHIJKLMNOPQRSTUVWXYZ 

U ’ Cipher UXYZLEAVNWORTHBCDFGIJKMPQS 

... Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

W Cipher. EAVNWORTHBCDFGIJKMPQSUXYZL 

Floras U. 



Plam. 



Cipher. 
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18. Principles of direct symmetry of position. — a. It was stated directly above that Fig. 5 
is a symmetrical cipher square, by which is meant that the letters in its successive horizontal 
lines show a symmetry of position with respect to one another. They constitute, in reality, one 
and only one sequence or series of letters, the sequences being merely displaced successively 1, 
2, 3, . . . intervals. The symmetry exhibited is obvious and is said to be visible, or direct. 
This fact can be used to good advantage, as has already been alluded to in par. 7j. 

6. Consider, for example, the pair of letters G„ and V„ in cipher alphabet (1) of Fig. 66. The 
letter V„ is the 15th letter to the right of G 0 . In cipher alphabet (2), V„ is also the 15th letter to 
the right of G„, as is the case in each of the four cipher alphabets in Fig. 66, since the relative 
positions they occupy are the same in each horizontal line in Fig. 6a, that is, in each of the suc- 
cessive recordings of the cipher component as the latter is slid to the right against the plain or 
normal component. If, therefore, the relative positions occupied by two letters, 0, and 0 2 , in 
such a cipher alphabet, Ci, are known, and if the position of 0! in another cipher alphabet, C 2 , 
belonging to the same series is known, then 0 2 may at once be placed into its correct position in C 2 . 
Suppose, for example, that as the result of an analysis based upon considerations of frequency, 
the following values in four cipher alphabets have been tentatively determined: 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

^ Cipher G Y V 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher N G P 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

W Cipher L B I 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

W Cipher. W IQ 

Fiausz 7a. 

c. The cipher components of these four secondary alphabets may, for convenience, be assem- 
bled into a cellular structure, hereinafter called a sequence reconstruction skeleton, as shown in 
Fig. 76. Regarding the top line of the reconstruction skeleton in Fig, 76 as being common to all 
four secondary cipher alphabets listed in Fig. 7a, the successive lines of the reconstruction skeleton 
may now be termed cipher alphabets, and may be referred to by the numbers at the left. 



Plain 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


u 


V 


w 


X 


Y 


Z 


Cipher 


ri 

2 

3 

.4 










G 




















Y 










V 






















N 




















G 










P 






















L 




















B 










I 






















W 




















I 










Q 






• 









FlOUSI 76. 

d. The letter G is common to Alphabets 1 and 2. In Alphabet 2 it is noted that N occupies 
the 10th position to the left of G, and the letter P occupies the 5th position to the right of G. 
One may therefore place these letters, N and P, in their proper positions in Alphabet 1, the letter N 
being placed 10 letters before G, and the letter P, 5 letters after G. Thus: 



Plain 


A 


B 


C 


D 


E 


F 


G ; 


H 




j 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


1 _ 










G 




J 




n 


p 










Y 










V 


N 
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Thus, the values of two new letters in Alphabet 1, viz, P 0 — Jp, and N 0 =U P have been automati- 
cally determined; these values were obtained without any analysis based upon the frequency of 
P c and N„. Likewise, in Alphabet 2, the letters Y and V may be inserted in these positions: 




This gives the new values V„=D P and Y„=Y P in Alphabet 2. Alphabets 3 and 4 have a common 
letter I, which permits of the placement of Q and W in Alphabet 3, and of B and L in Alphabet 4. 

e. The new values thus found are of course immediately inserted throughout the crypto- 
gram, thus leading to the assumption of further values in the cipher text. This process, viz, the 
reconstruction of the ‘primary components, by the application of the principles of direct symmetry 
of position to the cells of the reconstruction skeleton, thus facilitates and hastens solution. 

f. It must be clearly understood that before the principles of direct symmetry of position 
can be applied in cases such as the foregoing, it is necessary that the plain component be a known 
sequence. Whether it is the normal sequence or not is immaterial, so long as the sequence is 
known. Obviously, if the sequence is unknown, symmetry, even if present, cannot be detected 
by the cryptanalyst because he has no base upon which to try out his assumptions for 
symmetry. In other words, direct symmetry of position is manifested in the illustrative 
example because the plain component is a known sequence, and not because it is the 
normal alphabet. The significance of this point will become apparent later on in connection 
with the problem discussed in Par. 26b. 

19. Initial steps in the solution of a typical example. — a. In the light of the foregoing prin- 
ciples let a typical message now be studied. 

Message 



1 a 3 4 6 



A. 


Q W 




R 


I 


V 


w 


_Y 


c 


A 


I 


S 


P 


J 


L 


R 


B 


Z 


E 


Y 


Q 


W 


Y 


E 


U 


B. 


L 


w 


M 


~G 


"w 


I 


_c 


J 


c 


I 


M 


T 


Z 


E 


I 


M 


I 


B 


K 


N 


a 


JL 


J3_ 


JR 


_I 


C. 


V 


w 


_Y 


I 


G 


B 


w 


N 


B 


Q 


Q 


C 


G 


Q 


H 


I 


W 


J 


K_ 


A 


G 


E 


G 


X 


N 


D. 


I 


D 


M 


R 


U 


V 


E 


Z 


Y 


G 


Q 


I 


G 


V 


N 


C 


T 


G 


Y 


0 


B 


P 


D 


B 


L 


E. 


V 


C_ 


_G 


X_ 


G 


B 


K 


Z_ 


Z_ 


G 


I 


V 


X 


C 


U 


N 


T 


Z 


A 


0 


B 


W 


F 


E 


Q 


F. 


Q 


L 


F 


C 


0 


M 


T 


Y_ 


Z 


_T 


c 


C 


B 


Y 


Q 


0 


P 


D 


K_ 


A 


G 


D 


G 


I 


G 


G. 


V 


P 


W 


M 


R 


Q 


I 


I 


E 


W 


I 


_C_ 


_G_ 


x 


G 


B 


L 


G 


Q 


Q 


V 


B 


G 


R 


S 


H. 


M 


Y 


J 


J 


Y 


Q 


V 


F 


W 


Y 


R 


W 


N 


F 


L 


G 


2L 


N 


_F 


W 


M 


C 


J 


K 


X 


J. 


I 


D 


D 


R 


U 


0 


P 


J 


Q 


Q 


Z 


R 


H 


C 


N 


V 


w 


D 


Y 


Q_ 


R 


_D 


G 


D 


G 


K. 


B 


X 


D 


B 


N 


p 


X 


F 


P 


U 


Y 


X. 


N_ 


_F 


G 


M 


p 


_J_ 


JL 


JL 


S 


A 


N 


C 


D 


L. 


S 


E 


Z_ 


Z_ 


G 


I 


B 


E 


Y 


U 


K 


D 


H 


C 


A 


M 


B 


J 


J 


F 


K 


I 


L 


C 


J 


M. 


M 


F 


D 


Z_ 


T 


c 


T 


J 


R 


D 


M 


I 


Y 


Z 


Q 


A 


C 


J 


R 


R 


S 


B 


G 


Z 


N 


N. 


Q 


Y 


A 


H 


Q 


V 


E 


D 


C 


Q 


L 


X 


N 


C 


L 


L 


V 


V 


C 


S 


0 W B 


I 


I 


P. 


I 


V 


J 


R 


N 


w 


N 


B_ 


_R_ 


I 


V 


P_ 


J_ 


E 


L 


T 


A 


G 


D 


N 


I 


R 


G 


Q 


P 


Q. 


A 


T 


Y 


E 


W 


c 


B 


Y_ 


Z 


_T 


E 


V 


G 


Q 


U 


V 


P 


Y 


H 


L 


L 


R 


Z 


N 


Q 


R. 


X 


I 


N 


B 


A 


I 


K 


ff 


J 


a_ 


R 


_D 


Z 


Y 


F 


K 


W 


F 


Z 


L 


G 


W 


F 


J 


Q 


S. 


Q 


W 


J 


Y 


Q 


I 


B 


W 


R 


X 

































t 
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b. The principal repetitions of three or more letters have been underlined in the message and 
the factors (up to 20 only) of the intervals between them are as follows: 

QWBRIVWY 45=3, 5, 9, 15. 

CGXGB 60=2, 3, 4, 5, 6, 10, 12, 15, 20. 

PJEL 95=5,19. 

ZZGI 145=5. 

BRIV 285=3, 5, 15, 19. 

BRI 45=3, 5, 9, 15. 

KAG 75=3, 5, 15. 

QRD 165=3, 5, 15. 

QWB 45=3, 5, 9, 15. 

QWB 275=5, 11. 

WIC 130=2, 5, 10, 13. 

XNF 45=3, 5, 9, 15. 

YZT. 225=3, 5, 15. 

ZTC 145=3, 5. 

The factor 5 is common to all of these repetitions, and there seems to be every indication that 
five alphabets are involved. Since the message already appears in groups of five letters, it is 
unnecessary in this case to rewrite it in groups corresponding to the length of the key. The 
uniliteral frequency distribution for Alphabet 1 is as follows: 




ABCDEFGHIJKLMNOPQRSTUVWXYZ 



Figtob 8. 

c. Attempts to fit this distribution to the normal on the basis of a direct or reversed standard 
alphabet do not give positive results, and it is assumed that mixed alphabets are involved. 
Individual triliteral frequency distributions are then compiled and are shown in Fig. 9. These 
tables are similar to those made for single mixed alphabet ciphers, and are made in the same 
way except that instead of taking the letters one after the other, the letters which belong to the 
separate alphabets now must be assembled in separate tables. For example, in Alphabet 1, 
the trigraph QAC means that A occurs in Alphabet 1 ; Q, its prefix, occurs in Alphabet 5, and C, its 
suffix, occurs in Alphabet 2. All confusion may be avoided by placing numbers indicating the 

5 12 

alphabets in which they belong above the letters, thus: QAC 

Alphabet 1 



A B C D 


E 


P G 


H I J K L M N 


0 


P Q R S 


T 


U V W X Y Z 


QC GW NT 


TV 


AE 


AS UD UW IT UT 


QP 


NX -W LB LA 


LA 


IW NN QI UX QR 


PT OP TC 




AO 


WC FI QX II 


UP 


YW YW DE 




IW 


GK TT 




LX 


HW FW LV 0T 




NW QD RB 




UE 


OW WB 




LW 


ND LR SY 




QC QD 




LC 


GL 






GV WC 




GI 




GP 


GX 






WC GP 




QL 




QB 








XD AB 




RI 




NW 








GB JF 




Y V 




QE 








IV DI 




NY 




IP 








NR 




SW 




UP 








AK 




QW 












QB 
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Alphabet 2 



A B C D E F G H I JKL MNOPQRSTUVWXYZ 



SN RZ I J 1M GG MD 


MB 


IW QF 


WB 


BD 


ZH IP M2 


IX QB GN MJ 


TG VG QG GG VZ 


QQ 


BZ BG 




OD 


IG CG 


QF VY BD QA 


IE VG ID SZ 


QI 






VW 


LZ RZ 


LV QY PF 


MJ CB RG VD 


KL 






OJ 


MY 


IJ LM YN 


SG IG KH 


MY 






MJ 


CJ 


EG QB LN 


CY MJ RZ 


XN 






VJ 


AY 


VY 


IW AJ 








VY 




BN 



IJ 

BF 

RN 

VD 

QB 

KF 

GF 

QJ 



111 



Alphabet 3 



A B CDEFGHIJKLMNOPQRSTUVWXYZ 



YH WR 


PB BY WE 


CQ RC 


IE CC 


IC WG WB 


SJ 


VC PM VC 


WC 


BE 


IK 


PK 


LC 


EX DC 


WK 


DR WF 




KJ 


WE 


TE 


WR 


DR 


VW 


IV 


YJ 


XF 




BR 


WI 


EY 


CY 


WY 


XP 


TY 


CK 


XF 






TZ 


KZ 


WI 


XB 


WZ 


CX 


PQ 


AC 






IZ 


TA 


NR 


FZ 


WJ 


DI 


PE 


XC 






TE 


EZ 




EC 




CX 


BJ 


IB 






BZ 


RN 








LQ 


TR 








PH 


DY 








BR 


CR 


















DD 


VR 


















BZ 


PE 


















AD 


WY 


















RQ 




















VQ 
























Alphabet 4 










A B 


C D 


E F 


G H 


I J K 


L M N 0 


P Q R S 


T U V W X 


Y 


Z 



ZO NQ YA GG ZY NL MW 


AQ YG PL BN 


WR ZQ 


FU GH BI 


GN FY GN ZG ZG 


DL JI 


GN YU NW 


YL GG JY JA 




GQ BI 


GG GO YT 


DN XU 


ZI NG 


BI JF DA 




JQ MU 


GG BQ ZG 


NA FO 


FQ 


WQ JX 




GP GS 


DQ DT 


HN 


IW 


FQ 




GU DU 


EU YQ 


ND 


JL 






JD 


ZF GN 


HA 


JL 






JR 


JQ YT 


LJ 


YW 






JN 


FL 


DQ 








BI 




NL 








WX 




VS 













i 

i t 



152018 — 38 - 



I I: 
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Alphabet 5 



ABCDEFGHIJKLM NOPQRSTUVW 



X Y Z 



Cl 


CS 


JK IB QI RV CM 


JR 


KQ YB QA BQ MQ Rli ZC EL 


GI KI EQ 


KG 


RM 


YK YQ 


CM 


BV 


XI AB 


EQ RS CQ ZC RV 


El R- JQ 


KG 




XB 


EM 


FG 


VC CM 


YO 


ZE CN 


FM WR 


CH 




ZI 


RV 


ES 


C V 


QV 


RO 


EC 


BI 




IV 


II 


CL 


BP 


QZ 


PY 








XB 


RV 


ET 


ZQ 


YR 


YK 








DB 




HL 


RW 


ZA 


QV 








FM 




ZG 


DI 


HV 








ZI 








CL 







NX 

JR 

JQ 

YI 



Condensed table of repetitions 



1-2-3— 4-5-1— 2-3 


1-2-3 


1-2 


Q W B R I V W Y-2 


Q W B-3 


Q W-5 




V W Y-2 


V P-3 


2-3— 4-5-1 




V W— 3 


C G X G B-2 


2-3-4 






C G X-2 


2-3 


2-3— 4-1 


P J E-2 


C G-3 


P JEM 


W B R-2 


C J-3 




X N F-2 


P J-3 


3-4-5-1 




W B-3 


B-R-I-V 


3-4-5 


W F-3 


Z-Z-G-I-2 


B R 1-3 


W Y-3 




G X G-2 
JEM 


X N— 3 




Y Z T-2 


3-4 




Z Z G-2 


B R— 3 
G Q— 4 




4-5-1 


G X-3 




K A G-2 


J R-3 




X G B-2 


N F-3 




Z G 1-2 


Y Z-3 




Z T C-2 






R I V-3 


4-5 
R 1-3 




5-1-2 


Y Q-3 




I V W-2 
QRD-2 


Z T-3 




W I C-2 


5-1 
G B— 4 
I V-3 
Q Q-3 



Figure 9. 
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d. One now proceeds to analyze each alphabet distribution, in an endeavor to establish 
identifications of cipher equivalents. First, of course, attempts should be made to separate 
the vowels from the consonants in each alphabet, using the same test as in the case of a single 
mixed-alphabet cipher. There seems to be no doubt about the equivalent of Ep in each alphabet: 

1 2 3 4 5 

E=I„ , W 0 , G 0 , C 0 , Q c 

e. The letters of greatest frequency in Alphabet 1 are I, M, Q, V, B, G, L, R, S, and C. I, 

2 5 

has already been assumed to be E p . If W e and Q„=Ep, then one should be able to distinguish the 

vowels from the consonants among the letters M, Q, V, B, G, L, R, S, and C by ex amining the 
2 6 

prefixes of W CJ and the suffixes of Q 0 . The prefixes and suffixes of these letters, as shown by the 

triliteral frequency distributions, are these: 

2 2 

Prefixes of W„ (=Ep) 

QGKVRBIL 



6 6 

Suffixes of Q„ (=E P ) 
IQRXLVAZO 



1 2 5 

j. Consider now the letter M 0 ; it does not occur either as a prefix of W c , or as a suffix of Qp. 

Hence it is most probably a vowel, and on account of its high frequency it may be assumed to 

1 2 

be Op. On the other hand, note that Q<, occurs five times as a prefix of W„ and three times as 
6 

a suffix of Q„. It is therefore a consonant, most probably R p , for it would give the digraph 

51 12 

ER (=QQo) as occurring three times and RE (=QW„) as occurring five times. 

1 2 6 

g. The letter V 0 occurs three times as a prefix of W 0 and twice as a suffix of Q„. It is there- 

i 

fore a consonant, and on account of its frequency, let it be assumed to be T p . The letter B e 

2 5 

occurs twice as a prefix of W 0 but not as a suffix of Q„. Its frequency is only medium, and it is 

12" 

probably a consonant. In fact, the twice repeated digraph BW C is once a part of the trigraph 

6 12 5 

GBff, and G c , the letter of second highest frequency in Alphabet 5, looks excellent for T p . Might 

512 

not the trigraph GBW be THE? It will be well to keep this possibility in mind. 

1 2 6 

h. The letter G 0 occurs only once as a prefix of W 0 and does not occur as a suffix of Q e . It may 

1 2 

be a vowel, but one can not be sure. The letter L„ occurs once as a prefix of W„ and once as a 
5 1 2 

suffix of Q„. It may be considered to be a consonant. R„ occurs once as a prefix of W„, and twice 
5 1 1 

as a suffix of Q 0 , and is certainly a consonant. Neither the letter S 0 nor the letter C, occurs as a 
2 6 

prefix of W 0 or as a suffix of Q„; both would seem to be vowels, but a study of the prefixes and 

1 1 

suffixes of these letters lends more weight to the assumption that C„ is a vowel than that S, is a 

5 6 5 

vowel. For all the prefixes of C, viz, N, T, and W, are in subsequent analysis of Alphabet 5 classi- 
fied as consonants, as are likewise its suffixes, viz, T, C, and B in Alphabet 2. On the other hand, 
s 2 1 

only one prefix, L 0 , and one suffix, B c , of S 0 are later classified as consonants. Since vowels are 



1 

1 
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more often associated with consonants than with other vowels, it would seem that C 0 is more 

1 1 i 

likely to be a vowel than S a . At any rate C„ is assumed to be a vowel, for the present, leaving S a 

unclassified. 

i. Going through the same steps with the remaining alphabets, the following results are 
obtained: 



Alphabet 


Consonants 


Vowels 


1 


Q, V. B, L. R, G? 


I, M, C. 


2 


B, C, D, T. 


W, P, I. 


3 


J, N, D, Y, F. 


G, Z. 


4 


Y. Z, J. Q. 


C, E?, R?, B? 


5 


G, N, A, I. W, L, T. 


Q, U. 



20. Application of principles of direct symmetry of position. — a. The next step is to try 
to determine a few values in each alphabet. In Alphabet 1, from the foregoing analysis, the 
following data are on hand: 

Plain. ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher C? I C? M Q V 



Let the values of E D already assumed in the remaining alphabets, be set down in a reconstruction 
skeleton, as follows: 



Plain... 




A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


s 


T 


U 


V 


W 


X 


Y 


Z 




1 


C? 








I 








C? 












M 






Q 




V 
















2 










W 












































Cipher 


3 










G 














































4.. 










C 














































5 










Q 













































Figure 10 . 



b. It is seen that by good fortune the letter Q is common to Alphabets 1 and 5, and the 
letter C is common to Alphabets 1 and 4. If it is assumed that one is dealing with a case in which 
a mixed component is sliding against the normal component, one can apply the principles of 
direct symmetry of position to these alphabets, as outlined in Par. 18. For example, one may 
insert the following values in Alphabet 5: 



Plain 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


w 


X 


Y 


Z 


Cipherj 


fl 


C? 








I 








C? 












M 






Q 




V 














j . 

I s ■ 




M 






Q 




V 














C? 








I 








C? 
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« s t 

c. The process at once gives three definite values: M C =B P , V 0 =G P , I e =R p . Let these de- 
duced values be substantiated by referring to the frequency distribution. Since B and G are 
normally low or medium frequency letters in plain text, one should find that M c and V„, their 
hypothetical equivalents in Alphabet 5, should have low frequencies. As a matter of fact, they 
do not appear in this alphabet, which thus far corroborates the assumption. On the other hand, 

t B 

since I„=Rp, if the values derived from symmetry of position are correct, I„ should be of high 

frequency, and reference to the distribution shows that I„ is of high frequency. The position of 

C is doubtful; it belongs either under N p or V p . If the former is correct, then the frequency 
« 

of C„ should be high, for it would equal N p ; if the latter is correct, then its frequency should be 

s 

low, for it would equal V c . As a matter of fact, C c does not occur, and it must be concluded 

1 

that it belongs under V p . This in turn settles the value of C 0 , for it must now be placed definitely 
under I p and removed from beneath A p . 



d. The definite placement of C now permits the insertion of new values in Alphabet 4, and 
one now has the following: 



Plain... 




A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


w 


X 


y 


z 




fl 










I 








C 












M 






Q 




V 
















2 .......... 










W 












































Cipher 


3 










G 














































4. 


I 








C 












M 






Q 




V 
























.5 




M 






Q 




V 






















I 








C 











Figure 12. 



21. Subsequent steps in solution. — a. It is high time that the thus far deduced values, as 
recorded in the reconstruction skeleton, be inserted in the cipher text, for by this time it must seem 
that the analysis has certainly gone too far upon unproved hypotheses. The following results 
are obtained: 

Message 





1 


2 


3 




4 




5 


A. 


Q W B R I 


v w y c a 


I S P J L 


R 


B Z 


E Y 


Q W Y E U 




RE R 


T E E 


E 








R E 


B. 


L W M G W 


I C J C I 


M T Z E I 


M 


I B 


K N 


Q W B R I 




E 


E E R 


0 R 


0 






RE R 


c. 


V W Y I G 


B W N B Q 


QCGQH 


I 


W J 


K A 


G E G X N 
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D. 


I D M R U 


V E Z Y G 


Q I G V N 


C T G Y 0 


B P D B L 




E 


T 


R E P 


I E 




E. 


V C G X G 


B K Z Z G 


I V X C U 


N T Z A 0 


B W F E Q 




T E 




E E 




E E 


F. 


Q L F C 0 


M T Y Z T 


C C B Y Q 


OPDKA 


G D G I G 




R E 


0 


I E 




E A 


G. 


VPWMR 


Q I I E W 


I C G X G 


B L G Q Q 


V B G R S 




T K 


R 


E E 


E N E 


T E 


H. 


M Y J J Y 


QVFlf Y 


R W N F L 


GXNFIf 


MC JKX 




0 


R 


E 




0 


J. 


IDDRU 


0 P J Q Q 


Z R H C N 


V W D Y Q 


R D G D G 




E 


N E 


E 


T E E 


E 


K. 


B X D B N 


P X F P U 


Y X N F G 


MPJEL 


S A N C D 










0 


E 


L. 


S E Z Z G 


I B E Y U 


K D H C A 


MB JJF 


K I L C J 






E 


E 


0 


E 


M. 


MFDZT 


C T J R D 


M I Y Z Q 


A C J R R 


S B G Z N 




0 


I 


0 E 




E 


N. 


Q Y A H Q 


V E D C Q 


L X N C L 


L V V C S 


Q W B I I 




R E 


T EE 


E 


E 


RE A R 


P. 


I V J R N 


W N B R I 


V P J E L 


T A G D N 


I R G Q P 




E 


R 


T 


E 


E E N 


Q. 


A T Y E W 


C B Y Z T 


E V G Q U 


V P Y H L 


L R Z N Q 






I 


E N 


T 


E 


R. 


X I N B A 


IKBJQ 


R D Z Y F 


KKFZL 


GWFJQ 






E E 




E 


E E 


S. 


Q W J Y Q 


I B W R X 










RE E 


E 









i [ 



i 



i | 



i! 
ii 
\ ' 




REF ID:A64565 



35 

b. The combinations given are excellent throughout and no inconsistencies appear. Note 

12 3 

the trigraph QWB, which is repeated in the following polygraphs (underlined in the foregoing text): 

12 3 4 3 1 3123431 

QWBRIV. . .SQWBIII 

RE RT... RE ARE 

3 

e. The letter B 0 is common to both polygraphs, and a little imagination will lead to the 

3 

assumption of the value B 0 =P p , yielding the following: 

123451 8123451 

QWBRIV. . .SQWBIII 

REPORT. . .PREPARE 

4 5 1 2 3 4 

d. Note also (in F5) the polygraph I G V P W M, which looks like the word ATTACK. The 

AT K 

5 2 

frequency distributions are consulted to see whether the frequencies given for G„ and P e are hi gh 

8 

enough for T p and A p , respectively, and also whether the frequency of W„ is good enough for C p ; 

5 1 

it is noted that they are excellent. Moreover, the digraph GB 0) which occurs four times, looks 
i 

like TH, thus making B„=H P . Does the insertion of these four new values in our diagram of 

2 1 

alphabets bring forth any inconsistencies? The insertion of the value P 0 =A„ and B e =H„ gives 
no indications either way, since neither letter has yet been located in any of the other alphabets. 

5 

The insertion of the value G C =T„ gives a value common to Alphabets 3 and 5, for the value 
G,=E P was assumed long ago. Unfortunately an inconsistency is found here. The letter I 
has been placed two letters to the left of G in the mixed component, and has given good results 

3 

in Alphabets 1 and 5; if the value W„=C P (obtained above from the assumption of the word 

ATTACK) is correct, then W, and not I, should be the second letter to the left of G. Which shall 

s 

be retained? There has been so far nothing to establish the value of G C =E P ; this value was 
assumed from frequency considerations solely. Perhaps it is wrong. It certainly behaves like 
a vowel, and one may see what happens when one changes its value to 0 P . The following 
placements in the reconstruction skeleton result from the analysis, when only two or three new 
values have been added as a result of the clues afforded by the deductions: 



Plain... 




A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


w 


X 


Y 


Z 




ri 






S 




I 




G 


B 


C 












M 




P 


Q 


R 


V 


W 














2 


P 


Q 


R 


V 


W 
















S 




I 




G 


B 


C 












M 




Cipher' 


3 


R 


V 


W 
















S 




I 




G 


B 


C 












M 




P 


Q 




4— 


I 




G 


B 


c 












M 




P 


Q 


R 


V 


W 
















S 






.5 




M 




P 


Q 


R 


V 


W 
















S 




I 




G 


B 


C 


■ 









Figubz 13d. 
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e. Many new values are produced, and these are inserted throughout the message, yielding 
the following: 

1 2 3 4 5 

A. QWBRI VWYCA ISP JL RBZEY QWYEU 

REPORTEE EMY SR RE 

B. LWMGW ICJCI MTZEI MIBKN QWBRI 

EWCH ES ER 0 R OOP REPOR 

C. VWYIG BWNBQ QCGQH IWJKA GEGXN 

TE AT HE DE RSON EE G 0 

D. IDMRU VEZYG QIGVN CTGYO BPDBL 

E WO T TROOP 10 HAD 

E. VCGXG BKZZG IVXCU NTZAO BWFEQ 

TSOTH TEDE HE E 

F. QLFCO MTYZT CCBYQ OPDKA GDGIG 

R E 0 ISP E A GOAT 

G. VPWMR QIIEW ICGXG BLGQQ VBGRS 

TACKF ROM H ESO T H ONE TROOP 

H. MYJJY QVFWY RWNFL GXNFW MCJKX 

0 RDQ SE G HOS 

J. IDDRU OPJQQ ZRHCN VWDYQ RDGDG 

E 0 ANE CE TE ESOT 

K. BXDBN PXFPU YXNFG MPJEL SANCD 

HDQM TOA CE 

L. SEZZG IBEYU KDHCA MBJJF KILCJ 

C TER E OR OE 

M. MFDZT CTJRD MIYZQ ACJRR SBGZN 

0 I 0 00 E SOFCRO 

N. QYAHQ VEDCQ LXNCL LVVCS QWBII 

R ET EE E DBEPREPAR 

P. IVJRN WNBRI VPJEL TAGDN IRGQP 

EDO UPORTA 0 ECOND 

Q. ATYEW CBYZT EVGQU VPYHL LRZNQ 

HIR DON TA C E 

R. XINBA IKWJQ RDZYF KWFZL GWFJQ 

ODE ES E GEE 

S. QWJYQ IBWRX 

're e e r 0 
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22. Completing the solution. — a. Completion of solution is now a very easy matter. 
The mixed component is finally found to be the following sequence, based upon the word 



EXHAUSTING: 



EXHAUSTINGBCDFJKLHOPQRVVYZ 
and the completely reconstructed skeleton of the cipher square is shown in Fig. 136. 



Plain. 



Cipher... 



4...... 

{5 



A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


A 


U 


s 


T 


I 


N 


G 


B 


c 


D 


F 


J 


K 


L 


M 


0 


P 


Q 


R 


V 


W 


Y 


z 


E 


X 


H 


P 


Q 


R 


V 


W 


Y 


Z 


E 


X 


H 


A 


U 


S 


T 


I 


N 


G 


B 


C 


D 


F 


J 


K 


L 


M 


0 


R 


V 


W 


Y 


Z 


E 


X 


H 


A 


U 


S 


T 


I 


N 


G 


B 


C 


D 


F 


J 


K 


L 


M 


0 


P 


Q 


I 


N 


G 


B 


c 


D 


F 


J 


K 


L 


M 


0 


P 


Q 


R 


V 


W 


Y 


Z 


E 


X 


H 


A 


U 


S 


T 


L 


M 


0 


P 




R 


V 


W 


Y 


z 


E 


X 


H 


A 


U 


s 


T 


I 


N 


G 


B 


C 


D 


F 


J 


K 



Flora* 136. 



b. Note that the successive equivalents of A p spell the word APRIL, which is the key for the 
message. The plain-text message is as follows: 

REPORTED ENEMY HAS RETIRED TO NEWCHESTER. ONE TROOP IS REPORTED AT HEN- 
DERSON MEETING HOUSE: TWO OTHER TROOPS IN ORCHARD AT SOUTHWEST EDGE OF NEW- 
CHESTER. 2D SQ IS PREPARING TO ATTACK FROM THE SOUTH. ONE TROOP OF 3D SQ IS 
ENGAGING HOSTILE TROOP AT NEWCHESTER. REST OF 3D SQ IS MOVING TO ATTACK 
NEWCHESTER FROM THE NORTH. MOVE YOUR SQ INTO WOODS EAST OF CROSSROAD 539 AND 
BE PREPARED TO SUPPORT ATTACK OF 2D AND 3D SQ . DO NOT ADVANCE BEYOND NEWCHESTER . 
MESSAGES HERE. 

TREER, 

COL. 

c. The preceding case is a good example of the value of the principles of direct symmetry 
of position when applied properly to a cryptogram enciphered by the sliding of a mixed com- 
ponent against the normal. The cryptanalyst starts off with only a very limited number of 
assumptions and builds up many new values os a result of the placement of the few original 
values in the reconstruction skeleton. 

23. Solution of subsequent messages enciphered by the same cipher component. — a. 
Preliminary remarks . — Let it be supposed that the correspondents are using the same basic or 
primary component but with different key words for other messages. Can the knowledge of 
the sequence of letters in the reconstructed primary component be used to solve the subsequent 
messages? It has been shown that in the case of a monoalphabetic cipher in which a mixed 
alphabet was used, the process of completing the plain component could be applied to solve 
subsequent messages in which the same cipher component was used, even though the cipher 
component was set at a different key letter. A modification of the procedure used in that case 
can be used in this case, where a plurality of cipher alphabets based upon a sliding primary 
component is used. 
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b. The message. — Let it be supposed that the following message passing between the same 
two correspondents as in the preceding message has been intercepted: 

Message 



SFDZR 


YRRKX 


MIWLL 


AQRLU 


RQFRT 


IJQKF 


xuwBs 


MDJZK 


MICQC 


UDPTV 


TYRNH 


TRORV 


BQLTI 


QBNPR 


RTUHD 


PTIVE 


RMGQN 


LRATQ 


PLUKR 


KGRZF 


JCMGP 


IHSMR 


GQRFX 


BCABA 


OEMTL 


PCXJM 


RGQSZ 


VB 











c. Factoring and conversion into plain component equivalents. — The presence of a repetition 
of a four-letter polygraph whose interval is 21 letters suggests a key word of seven letters. There 
are very few other repetitions, and this is to be expected in a short message with a key of such 



length. 










i 


2 


3 


4 


6 


6 


7 


S 


F 


D 


z 


R 


Y 


R 


R 


K X 


M 


I 


W 


L 


L 


A Q 


R 


L 


U 


R 


Q 


F 


R 


T 


I 


J 


Q 


K 


F 


X 


U 


W 


B 


S 


M 


D 


J 


Z 


K 


M 


I 


C 


Q C 


U 


D 


P 


T 


V 


T 


Y 


R 


N H 


T 


R 


0 


R 


V 


B Q 


L 


T 


I 


Q 


B 


N 


P 


R 


R 


T 


U 


H 


D 


P 


T 


I 


V 


E 


R 


M 


G 


Q 


N 


L 


R 


A 


T Q 


P 


L 


U 


K 


R 


K 


G 


R 


Z 


F 


J 


C 


M 


G 


P 


I 


H 


S 


M 


R G 


Q 


R 


F 


X 


B 


C 


A 


B 


A 


0 


E 


M 


T 


L 


P 


C 


X J 


M 


R 


G 


Q 


S 


Z 


V 


B 









d. Transcription into periods. — Let the message 
be written in groups of seven letters, in columnar 
fashion, as shown in Fig. 14. The letters in each 
column belong to a single alphabet. Let the letters 
in each column be converted into their plain-com- 
ponent equivalents by setting the reconstructed 
cipher component against the normal alphabet at any 
arbitrarily selected point, for example, that shown 
below: 



J 2 3 4 8 6 7 

FNMZVYV 

V P B R H X Q 
QDUVQEV 
U N V G H 0 U 
P N B E X K F 
R M 0 Z P R H 
LULEHTG 
W G Y V I C G 

V S V W K U Q 
G H U K I T V 
VGECMTG 
H W A V R J U 
IQVDGUT 
Q E P V P J V 
Z N 0 L R J T 
HCFRVJU 
VNBKLDK 
D S A R G Q T 
L B 0 R V J U 
F Z W K 



Fiqube 14. 



Fiqdbe 16. 



Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher EXHAUSTINGBCDFJKLMOPQRVWYZ 



The columns of equivalents are now as shown in Fig. 15. 

e. Examination and selection of generatrices. — It has been shown that in the case of a mono- 
alphabetic cipher it was merely necessary to complete the normal alphabet sequence beneath 
the plain-component equivalents and the plain text all reappeared on one generatrix. It was 
also found that in the case of a multiple-alphabet cipher involving standard alphabets, the plain- 
text equivalents of each alphabet reappeared on the same generatrix, and it was necessary only 
to combine the proper generatrices in order to produce the plain text of the message. In the 
case at hand both processes are combined: the normal alphabet sequence is continued beneath 
the letters of each column and then the generatrices are combined to produce the plain text. 
The completely developed generatrix diagrams for the first two columns are as follows (Fig. 16): 
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OOUJKH 1 

FVQUPRLWVGVHIQZHVDLF 

1 GWRVQSMXWHWIJRAIWEMG 

2 HXSWRTNYXIXJKSBJXFNH 

3 IYTXSUOZYJYKLTCKYGOI 

4 JZUYTVPAZKZLMUDLZHPJ 

5 KAVZUWQBALAMNVEMAIQK 

6 LBWAVXRCBMBNOWFNBJRL 

7 MCXBWYSDCNCOPXGOCKSM 

8 NDYCXZTEDODPQYHPDLTN 

9 OEZDYAUFEPEQRZIQEMUO 

10 PFAEZBVGFQFRSAJRFNVP 

11 QGBFACWHGRGSTBKSGOWQ 

12 RHCGBDXIHSHTUCLTHPXR 

13 SIDHCEYJITIUVIMJIQYS 

14 TJEIDFZKJUJVWENVJRZT 

15 UKFJEGALKVKWXFOWKSAU 

16 VLGKFHBMLWLXYGPXLTBV 

17 WMHLGICNMXMYZHQYMUCW 

18 XNIMHJDONYNZAIRZNVDX 

19 YOJNIKEPOZOABJSAOWEY 

20 ZPKOJLFQPAPBCKTBPXFZ 

21 AQLPKMGRQBQCDLUCQYGA 

22 BRMQLNHSRCRDEMVDRZHB 

23 CSNRMOITSDSEFNWESAIC 

24 DTOSNPJUTETFGOXFTBJD 

25 EUPTOQKVUFUGHPYGUCKE 

noma 



OoLumt 3 

NPDNNMUGSHGWQENCNSBZ 

1 OQEOONVHTIHXRFODOTCA 

2 PRFPPOWIUJIYSGPEPUDB 

3 QSGQQPXJ VKJ ZTHQFQVEC 

4 RTHRRQYKWLKAUIRGRWFD 

5 SUISSRZLXMLBV J SHSXGE 

6 TVJTTSAMYNMCWKTITYHF 

7 UWKUUTBNZONDXLUJUZIG 

8 VXLWUCOAPOEYMVKVAJH 

9 WYMWWVDPB QPFZNWLWBKI 

10 XZNXXWEQCRQGAOXMXCLJ 

11 YAOYYXFRDSRHBPYNYDMK 

12 ZBPZZYGSETSICQZOZENL 

13 ACQAAZHTFUTJDRAPAFOM 

14 BDRBBAIUGVUKESBQBGPN 

15 CESCCBJVHWVLFTCRCHQO 

16 DFTDDCKWIXWMGUDSDIRP 

17 EGUEEDLXJYXNHVETEJSQ 

18 FHVFFEMYKZYOIWFUFKTR 

19 GIWGGFNZLAZPJXGVGLUS 

20 H JXHHG 0 AMB AQKYHWHMVT 

21 IKYIIHPBNCBRLZIXINWU 

22 JLZJJIQCODCSMAJYJOXV 

23 KMAKKJRDPEDTNBKZKPYW 

24 LNBLLKSEQFEU 0 CLALQZX 

25 MOGMMLTFRGFVPDMBMRAY 



X 3 

C 0 
S Q 
N E 
R 0 
M 0 

0 N 

1 V 
T H 
S T 
D I 
S H 
E X 
F R 
N F 
W 0 
E D 
S 0 
A T 
I C 
C A 



j. Combining the selected generatrices . — After some experi- 
menting with these generatrices the 23d generatrix of Column 1 and 
the 1st of Column 2, which yield the digraphs shown in Pig. 17a, 
are combined. The generatrices of the subsequent columns are 
examined to select those which may be added to these already 
selected in order to build up the plain text. The results are shown 
in Fig. 176. This process is a veiy valuable aid in the solution of 
messages after the primary component has been recovered as a 
result of the longer and more detailed analysis of the frequency 
distributions of the first message intercepted. Very often a short 
message can be solved in no other way than the one shown, 
if the primary component is completely known. 

g. Recovery of the key . — It may be of interest to find the key 
word for the message. Assuming that enciphering method num- 
ber 1 (see Par. 7 f, page 6) were known to be employed, all that 
is necessary is to set the mixed component of the cipher alphabet 
underneath the plain component so as to produce the cipher letter 
indicated as the equivalent of any given plain-text letter in each 
of the alphabets. For example, in the first alphabet it is noted that 
C P =S<,. Adjust the two components under each other so as to 
bring S of the cipher component beneath C of the plain component, 



Roto* 17b. thus; 



1 


a 


3 


4 


s 


6 


7 


c 


0 


F 


I 


R 


s 


T 


s 


Q 


U A 


D 


R 


0 


N 


E 


N E 


M 


Y 


T 


R 


0 


0 


p 


D 


I 


S 


M 


0 


U 


N T 


E 


D 


0 


N 


H 


I 


L 


L 


F 


I 


V 


E 


N 


I 


N E 


T 


H 


R 


E 


E 


W E 


S 


T 


0 


F 


G 


0 


0 


D 


I 


N T 


E 


N 


T 


S 


H 


X 


L 


I 


N 


E 


E 


X 


T 


E 


N 


D 


S 


F 


R 


0 


M 


C 


0 


R 


N 


F 


I 


E 


L 


D 


T 


W 


0 


H 


U 


N 


D 


R 


E 


D 


Y 


A 


R 


D 


S 


S 


0 


U 


T 


H 


X 


I 


A 


T 


T 


A 


C 


K 


R 


I 


C 


H 


A 


R 


D 


S 


C 


A 


P 


T 









Flops* 176. 
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Plain ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher EXHAUSTINGBCDFJKLMOPQRVWYZ 

It is noted that A„=A 0 . Hence, the first letter of the key word to the message is A. The 2d, 
3d, 4th, . . . 7th key letters are found in exactly the same manner, and the following is obtained: 

When C 0 F I R S T equals 

S F D Z R Y R then A p successively equals 
AZIMUTH 

24. Summation of relative frequencies as an aid to the selection of the correct generatrices. — 
a. In the foregoing example, under subparagraph j, there occurs this phrase: “After some 
experimenting with these generatrices . . By this was meant, of course, that the selection of 
the correct initial pair of generatrices of plain-text equivalents is in this process a matter of trial 
and error. The test of “correctness” is whether, when juxtaposed, the two generatrices so 
selected yield “good” digraphs, that is, high-frequency digraphs such as occur in normal plain 
text. In his early efforts the student may have some difficulty in selecting, merely by ocular 
examination, the most likely generatrices to try. There may be in each diagram several gen- 
eratrices which contain good assortments of high-frequency letters, and the number of trials of 
combinations of generatrices may be quite large. Perhaps a simple mathematical method may 
be of assistance in the process. 

b. Suppose, in Fig. 16, that each letter were accompanied by a number which corresponds 
to its relative frequency in normal English telegraphic text. Then, by adding the numbers along 
each horizontal line, the totals thus obtained will serve as relative numerical measures of the 
frequency values of the respective generatrices. Theoretically, the generatrix with the greatest 
value will be the correct generatrix because its total will represent the sum of the individual 
values of the actual plaintext letters. In actual practice, of course, the generatrix with the 
greatest value may not be the correct one, but the correct one will certainly be among the three 
or four generatrices with the largest values. Thus, the number of trials may be greatly reduced, 
in the attempt to put together the correct generatrices. 

e. Using the preceding message as an example, note the respective generatrix values in Fig. 
18. The frequency values of the respective letters shown in the figure are based upon the normal 
distribution for War Department telegraphic text (see Table 3, Appendix 1, Military Crypt- 
analysis, Part I). 
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Column 1 



Generatrix 

0 


F 


V 


Q 


u 


P 


R 


L 


W 


V 


G 


V 


H I 
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2 
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6 


2 


0 


2 


3 


2 


7 0 


8 


7 


7 


2 


13 2 


2 


2 


H 


X 


S 


w 


R 


T 


N 


Y 


X 


I 


X 


J K 


s 


B 


J 
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H 
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Y 


T 


X 
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U 
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Y 


J 


Y 
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T 


C 


K 


Y 
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74 




7 


2 


9 
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< 


3 


8 
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2 


0 


2 


0 4 


9 


8 


0 


2 
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7 


4 


J 


Z 


U 


Y 


T 


V 


P 


A 


z 


K 


z 


L M 


U 


D 


L 


Z 


H P 
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49 
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d. It will be noted that the frequency value of the 23d generatrix for the first column of 
cipher letters is the greatest; that of the first generatrix for the second column is the greatest. 
In both cases these are the correct generatrices. Thus the selection of the correct generatrices 
in such cases has been reduced to a purely mathematical basis which is at times of much assistance 
in effecting a quick solution. Moreover, an understanding of the principles involved will be of 
considerable value in subsequent work. 

25. Solution by the probable-word method. — a. Occasionally one may encounter a crypto- 
gram which is so short that it contains no recurrences even of digraphs, and thus gives no indi- 
cations of the number of alphabets involved. If the sliding mixed component is known, one may 
apply the method illustrated in Par. 15, assuming the presence of a probable word, checking it 
against the text and the sliding components to establish a key, if the correspondents are using 
key words. 

6. For example, suppose that the presence of the word ENEMY is assumed in the message 
in Par. 236 above. One proceeds to check it against an unknown key word, sliding the already 
reconstructed mixed component against the normal and starting with the first letter of the 
cryptogram, in this manner: 

When ENEMY equals 

SFDZR then Aj, successively equals 
XENFW 

The sequence XENFW spells no intelligible word. Therefore, the location of the assumed word 
ENEMY is shifted one letter forward in the cipher text, and the test is made again, just as was 
explained in Par. 15. When the group AQRLU is tried, the key letters ZIMUT are obtained, 
which, taken as a part of a word, suggests the word AZIMUTH. The method must yield solution 
when the correct assumptions are made. 

c. The danger to cryptographic security resulting from the inclusion of cryptographed 
addresses and signatures in cryptographic messages becomes quite obvious in the light of 
solution by the probable-word method. To illustrate, reference is made to the message employed 
in Pars. 19-22. It will be noted in Par. 226 that the message carried a signature (Treer, Col.) 
and that the latter was enciphered. Suppose that this were an authorized practice, and that 
every message could be assumed to conclude with a cryptographed signature. The signature 
“TREER COL” would at once afford a very good basis for the quick solution of subsequent mes- 
sages emanating from the same headquarters as did the first message, because presumably this 
same signature would appear in other messages. It is for this reason that addresses and signa- 
tures must not be cryptographed; if they must be included they should be cryptographed in a 
totally different system or by a wholly different method, perhaps by means of a special address 
and signature code. It would be best, however, to omit all addresses and signatures, and to 
let the call signs of the headquarters concerned also convey these parts of the message, leaving 
the delivery to the addressee a matter for local action. 

26. Solution when the plain component is a mixed sequence, the cipher component, the 
normal. — a. This falls under Case B (2) outlined in Par. 6. It is not the usual method of 
employing a single mixed component, but may be encountered occasionally in cipher devices. 

6. The preliminary steps, as regards factoring to determine the length of the period, are 
the same as usual. The message is then transcribed into its periods. Frequency distributions 
are then made, as usual, and these are attacked by the principles of frequency and recurrence. 
An attempt is made to apply the principles of direct symmetry of position, but this attempt 
will be futile, for the reason that the plain component is in this case an unknown mixed sequence. 
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(See Par. 18rf.) Any attempt to find symmetry in the secondary alphabets based upon the normal 
sequence can therefore disclose no symmetry because the symmetry which exists is based upon a 
wholly different sequence. 

c. However, if the principles of direct symmetry of position are of no avail in this case, 
there are certain other principles of symmetry which may be employed to great advantage. 
To explain them an actual example will be used. Let it be assumed that it is known to the 
cryptanalyst that the enemy is using the general system under discussion, vis, a mixed sequence, 
variable from day to day, is used as plain component; the normal sequence is used as cipher 
component; and a repeating key, variable from message to message, is used in the ordinary 
manner. 

The following message has been intercepted: 



t 



2 



3 



4 



S 



s 



A. Q E 0 V K 

B. “V R Z M 0 

C. U Q A X R 

D. U L I B K 

E. L A D H Y 

F. S P B H B 

G. H S A H Y 

H. N X A L B 

J. SHOE 

K. N Q G U Y 

L. J U U G B 

M. V X N W A 

N. P K M B X 

P. F L N U J 

Q. G P G T Y 

R. J K A T E 

S. TUULZ 

T. X C G Z A 
V. S R Q Z L 



LRMLZ 
Y A A M P 
H U F B U 
N D A X B 
B V N F V 
X V A Z G 
T M G U J 
TCDLM 
GQDHO 
J I W Y Y 
J H R V X 
F A A N E 
H G E R Y 
N D T V X 
T E C X B 
G U W B R 
L A A H Y 
H D G T L 
A V N H L 



J V G T G 
D K E I J 
K Q Y M U 
X U D G L 
U E E M E 
U D Y U E 
H Q X P P 
I V A A A 
Y H I V P 
T M A H W 
E R F L E 
M K G H B 
T M W L Z 
J R Z T L 
HQEBR 
H U Q ff M 
J G D V K 
VKMBW 
G V W V K 



N D L V K 
S F M Y 0 
N E L V T 
L A D V K 
FFMTE 
LKMMA 
D K 0 U E 
N S Z I L 
N C R R E 
X R L B L 
G W G U 0 
SSNLO 
N Q C Y Y 
0 P A H C 
K V W M U 
V R Q B W 
L K R R E 
ISAUE 
F I G H P 



EVNTY 

Y H M M E 
K Q I L E 
P 0 A Y 0 
G V W B Y 
E U D D K 
X U Q V B 
0 V W V P 
XKDQZ 
0 A D L G 
X E D T P 
K J C B Z 
T M W I P 
D F Z Y Y 
N I N G J 

Y R F B F 
X K N A 0 
F D N W P 
G E C Z U 



ERHUE 
G Q A M B 
K Z B U E 
D K K Y K 
T V D Z L 
N C F S H 
F V ff B X 
Y A G Z L 
G K N C G 
N Q G U Y 
D K E I Z 
T G G L 0 
D K A T E 
D E Y C L 
I Q D L P 
K M ff M B 
N D S B X 
N L Z I J 
K Q A P 



d. A study of the recurrences and factoring their intervals discloses that five alphabets are 
involved. Uniliteral frequency distributions are made and are shown in Fig. 19a: 



Alphabet 1 



- - 2211 gg 

ABCDEFGHIJKLMNOPQRSTUVffXYZ 

Alphabet 2 

5 — 



ABCDEFGHIJKLMNOPQRSTUVffXYZ 
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Alphabet 3 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Alphabet 4 



aIcdefghijklmnopqrstuvwxyz 

Alphabet 5 



aIcdefghijklmnopqrstuvwxyz 

Floras 19a. 

e. Since the cipher component in this case is the normal alphabet, it follows that the jive 
frequency distributions are based upon a sequence which is known, and therefore, the five frequency 
distributions should manifest a direct symmetry of distribution of crests and troughs . By virtue of 
this symmetry and by shifting the five distributions relative to one another to proper superim- 
positions, the several distributions may be combined into a single uniliteral distribution. Note 
how this shifting has been done in the case of the five illustrative distributions: 

Alphabet 1 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Alphabet 2 

xyzabcdefghijklmnopqIstuvw 

Alphabet 3 



TUVWXYZABC DEFGHIJKLMNOPQRS 

Alphabet 4 



OPQRSTUVWXYZABCDEFGHIJKLMN 

Alphabet 5 



1 3 * 2 3 = § 

RSTUVWXYZABCDEFGHIJKLMNOPQ 

Figure 196. 



152018—88 1 
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y. The superimposition of the respective distributions enables one to convert the cipher 

letters of the five alphabets into one alphabet. Suppose it is decided to convert Alphabets 

2, 3, 4, and 5 into Alphabet 1. It is merely necessary to substitute for the respective letters in 

the four alphabets those which stand above them in Alphabet 1. For example, in Fig. 196, X e 

in Alphabet 2 is directly under A, in Alphabet 1 ; hence, if the superimposition is correct then 
2 , 1 

X o =A e - Therefore, in the cryptogram it is merely necessary to replace every X 0 in the second 
position by A 0 . Again T„ in Alphabet 3=A 0 in Alphabet 1; therefore, in the cryptogram one 
replaces every T* in the third position by A c . The entire process, hereinafter designated as 
conversion into monoalpkabetic terms, gives the following converted message; 





i 


2 




8 


4 


8 


s 


A. 


Q H V H T 


L U T X I 


J 


Y N F P 


N G S H T 


E Y U F H 


E U T G N 


B. 


V U G Y X 


Y D H Y Y 


D 


N L U S 


S I T K X 


Y K T Y N 


G T H Y K 


C. 


UTHJA 


HX1IND 


K 


T F Y D 


N H S H C 


K T P X N 


K C I G N 


D. 


U 0 P N T 


N G H J K 


X 


X K S U 


LDKH1 


P R H K X 


D N R K T 


E. 


L D K T H 


B Y U R E 


U H L Y N 


F I T F N 


G Y D N H 


T Y K L U 


F. 


S S I T K 


X Y H L L 


U 


G F G N 


L N T Y J 


E X K P T 


N F M E Q 


G. 


H V H T H 


T P N G S 


H 


T E B Y 


D N V G N 


X X X H K 


FYDHG 


H. 


N A H X K 


T F K X V 


I 


Y H M J 


N V G U U 


0 Y D H Y 


YDNLU 


J. 


S K T Y N 


G T K T X 


Y K P H Y 


N F Y D N 


X N K C I 


G N U 0 P 


K. 


N T N G H 


J L D K H 


T 


P H T F 


XUSNU 


0 D K X P 


N T N G H 


L. 


J X B S K 


J K Y H G 


E U M X N 


G Z N G X 


X H K F Y 


D N L U I 


M. 


V A U I J 


F D H Z N 


M 


N N T K 


S V U X X 


KliJNI 


T J N X X 


N. 


P N T N G 


H J L D H 


T 


P D X I 


N T J K H 


T P D U Y 


D N H F N 


P. 


F 0 U G S 


N G A H G 


J 


DGFU 


0 S H T L 


D I G K H 


D H F 0 U 


Q. 


G S N F H 


THJ JK 


H 


T L N A 


K Y D Y D 


N L U S S 


I T K X Y 


R. 


J N H F N 


G X D N A 


H 


XXIV 


V U X N F 


Y U M N 0 


K P D Y K 


S. 


T P B X I 


L D H T H 


J 


J K H T 


L N Y D N 


XNUMX 


N G Z N G 


T. 


X F N L J 


H G N F U 


V 


N T N F 


I V H G N 


F G U I Y 


N 0 G U S 


y. 


SUXLU 


AYUTU 


G Y D H T 


F L N T Y 


G H J L D 


K T H B 



The uniliteral frequency distribution for this converted text follows. Note that the frequency 
of each letter is the sum of the five frequencies in the corresponding columns of Fig. 196. 




ABC 



its 




31 7 30 88 64 18 21 38 22 8 68 8 14 a 8 19 *8 38 IS 86 39 3 



Fiausi 20. 
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g. The problem having been reduced to monoalphabetic terms, a triliteral frequency distri- 
bution can now be made and solution readily attained by simple principles. It yields the 
following: 

JAPAN CONSULTED GERMANY TODAY ON REPORTS THAT THE COMMUNIST INTERNATIONAL 
WAS BEHIND THE AMAZING SEIZURE OF GENERALISSIMO CHIANG KAI SHEK IN CHINA. 
TOKYO ACTED UNDER THE ANTICOMMUNIST ACCORD RECENTLY SIGNED BY JAPAN AND GER- 
MANY. THE PRESS SAID THERE WAS INDISPUTABLE PROOF THAT THE COMINTERN INSTI- 
GATED THE SEIZURE OF GENERAL CHIANG AND SOME OF HIS GENERALS. MILITARY OB- 
SERVERS SAID THE COUP WOULD HAVE BEEN IMPOSSIBLE UNLESS GENERAL CHANG HSUEN 
LIANG HOTHEADED FORMER WAR LORD OF MANCHURIA HAD FORMED AN ALLIANCE WITH THE 
COMMUNIST LEADERS HE WAS SUPPOSED TO BE FIGHTING. SUCH AN ALLIANCE THESE 
OBSERVERS DECLARED OPENED UP A RED ROUTE FROM MOSCOW TO NORTH AND CENTRAL 
CHINA. 

h. The reconstruction of the plain component is now a very simple matter. It is found to 
be as follows: 

HYDRAULICBEFGJKMNOPQSTVWXZ 

Note also, in Fig. 196, the keyword for the message, (HEAVY), the letters being in the columns 
headed by the letter H. 

i. The solution of subsequent messages with different keys can now be reached directly, by 
a simple modification of the principles explained in Par. 18. This modification consists in using 
for the completion sequence the mixed plain component (now known) instead of the normal alpha- 
bet, after the cipher letters have been converted into their plain-component equivalents. Let 
the student confirm this by experiment. 

j. The probable-word method of solution discussed under Paragraph 20 is also applicable 
here, in case of very short cryptograms. This method presupposes of course, possession of the 
mixed component and the procedure is essentially the same as that in Par. 20. In the example 
discussed in the present paragraph, the letter A on the plain component was successively set 
against the key letters HEAVY ; but this is not the only possible procedure. 

k. The student should go over carefully the principle of “conversion into monoalphabetic 
terms” explained in subparagraph/ above until he thoroughly understands it. Later on he will 
encounter cases in which this principle is of very great assistance in the cryptanalysis of more 
complex problems. (Another example will be found under Par. 45.) 

l. The principle illustrated in subparagraph e, that is, shifting two or more monoalphabetic 
frequency distributions relatively so as to bring them into proper alignment for amalgamation 
into a single monoalphabetic distribution, is called matching. It is a very important crypt- 
analytic principle. Note that its practical application consists in sliding one monoalphabetic 
distribution against the other so as to obtain the best coincidence between the entire sequence 
of crests and troughs of one distribution and the entire sequence of crests and troughs of the other 
distribution. When the best point of coincidence has been found, the two sequences may be 
amalgamated and theoretically the single resultant distribution will also be monoalphabetic in 
character. The successful application of the principle of matching depends upon several factors. 
First, the cryptographic situation must be such that matching is a correct cryptographic step. 
For example, the distributions in figure 196 are properly subject to matching because the cipher 
component in the basic sequences concerned in this problem is the normal sequence, while the 
plain component is a mixed sequence. But it would be futile to try to match the distributions 
in figure 9, for in that case the cipher component is a mixed sequence, the plain component is 
the normal sequence. Hence, no amount of shifting or matching can bring the distributions of 
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figure 9 into proper superimposition for correct amalgamation. (If the occurrences in the various 
distributions in figure 9 had been distributed according to the sequence of letters in the mixed 
component, then matching would be possible; but in order to be able to distribute these occur- 
rences according to the mixed component, the latter has to be known — and that is just what is 
unknown until the problem has been solved.) A second factor involved in successful matching 
is the number of elements in the two distributions forming the subject of the test. If both 
of them have very few tallies, there is hardly sufficient information to permit of matching with 
any degree of assurance that the work is not in vain. If one of them has many tallies, the other 
only a few, the chances for success are better than before, because the positions of the blanks in 
the two distributions can be used as a guide for their proper superimposition. 

m. There are certain mathematical and statistical procedures which can be brought to bear 
upon the matter of cryptanalytic matching. These will be presented in a later text. However, 
until the student has studied these mathematical and statistical methods of matching distri- 
butions, he will have to rely upon mere ocular examination as a guide to proper superimposition. 
Obviously, the more data he has in each distribution, the easier is the correct superimposition 
ascertained by any method. 
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Section VI 

REPEATING-KEY SYSTEMS WITH MIXED CIPHER ALPHABETS, II 



Further cases to be considered. 



Paragraph 

27 

28 

29 

30 



oned in Para- 



Identical primary mixed components proceeding in the same direction 

Cryptographing and decryptographing by means of identical primary mixed components 

Principles of solution 

27. Further oases to he considered. — a. Thus far Cases B (1) and (2), menti 
graph 6 have been treated. There remains Case B (3), and this case has been further subdivided 
as follows: 

Case B (3). Both components are mixed sequences. 

(a) Components are identical mixed sequences. 

(1) Sequences proceed in the same direction. (The secondary alphabet are mixed 

alphabets.) 

(2) Sequences proceed in opposite directions. (The secondary alphabets are 

reciprocal mixed alphabets.) 

(b) Components are different mixed sequences. (The secondary alphabets are mixed 

alphabets.) 

b. The first of the foregoing subcases will now be examined. 

28. Identical primary mixed components proceeding in the same direction. — a. It is often 
the case that the mixed components are derived from an easily remembered word or phrase, 
so that they can be reproduced at any time from memory. Thus, for example, given the key 
word QUESTIONABLY, the following mixed sequence is derived: 

QUESTIONABLYCDFGHJKMPRVffXZ 

b. By using this sequence as both plain and cipher component, that is, by sliding this 
sequence against itself, a series of 26 secondary mixed alphabets may be produced. In encipher- 
ing a message, sliding strips may be employed with a key word to designate the particular and 
successive positions in which the strips are to be set, the same as was the case in previous examples 
of the use of sliding components. The method of designating the positions, however, requires 
a word or two of comment at this point. In the examples thus far shown, the key letter, as 
located on the cipher component, was always set opposite A, as located on the plain component; 
possibly an erroneous impression has been created, viz, that this is invariably the rule. This 
is decidedly not true, as has already been explained in paragraph 7c. If it has seemed to be the 
case that 0 k always equals A p , it is only because the text has dealt thus far principally with cases in 
which the plain component is the normal sequence and its intital letter, which usually consti- 
tutes the index for juxtaposing cipher components, is A. It must be emphasized, however, 
that various conventions may be adopted in this respect; but the most common of them is to 
employ the initial letter of the plain component as the index letter. That is, the index letter, 
0i, will be the initial letter of the mixed sequence, in this case, Q. Furthermore, to prevent the 
possibility of ambiguity it will be stated again that the pair of enciphering equations employed 
in the ensuing discussion will be the first of the 12 set forth under Par. 7 f, viz, 0 k / 2 =0i/i ; 0 P /, =0 O / S . 
In this case the subscript “1” means the plain component, the subscript "2”, the cipher 
component, so that the enciphering equation is the following; 0*/ ? ==@i/ p ; 0 p / p ==9«/«. 

( 49 ) 



*>■ 
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c. By setting the two sliding components against each other in the two positions shown 
below, the cipher alphabets labeled (1) and (2) given by two key letters, A and B, are seen to be 
different. 

Key Letteh=A 0, 

Plain component QUESTIONABLYCDFGHJKMPRVWXZQUESTIONABLYCDFGHJKMPRVWXZ 

Cipher component QUESTIONABLYCDFGHJKMPRVWXZ 

T 

G * 

Secondary alphabet (1): 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher HJPRLVWXDZQKUGFEASYCBTIOMN 

Key Letter =B ©i 

i. 

Plain component QUESTIONABLYCDFGHJKMPRVWXZQUESTIONABLYCDFGHJKMPRVWXZ 

Cipher component.. QUESTIONABLYCDFGHJKMPRVWXZ 

t 

©* 

Secondary alphabet (2): 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher JKRVYWXZFQUMEHGSBTCDLIONPA 

d. Very frequently a quadricular or square table is employed by the correspondents, instead 
of sliding strips, but the results are the same. The cipher square based upon the word QUESTION- 
ABLY is shown in Fig. 21. It will be noted that it does nothing more than set forth the successive 
positions of the two primary sliding components; the top line of the square is the plain component, 
the successive horizontal lines below it, the cipher component in its various juxtapositions. The 
usual method of employing such a square (i. e., corresponding to the enciphering equations 
6t le =8 Up ; ©p/p=0 B /«) is to take as the cipher equivalent of a plain-text letter that letter which 
lies at the intersection of the vertical column headed by the plain-text letter and the horizontal 
row begun by the key letter. For example, the cipher equivalent of Ep with keyletter T is the 
letter 0„; or E p (T k )=0 e . The method given in paragraph b, for determining the cipher equiva- 
lents by means of the two sliding strips yields the same results as does the cipher square. 
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QUESTIONABLYCDFGHJKMPRVWXZ 

UESTIONABLYCDFGHJKMPRVWXZQ 

ESTIONABLYCDFGHJKMPRVWXZQU 

STIONABLYCDFGHJKMPRVWXZQUE 

TIONABLYCDFGHJKMPRVWXZQUES 

IONABLYCDFGHJKMPRVWXZQUEST 

ONABLYCDFGHJKMPRVWXZQUESTI 

NABLYCDFGHJKMPRVWXZQUESTIO 

ABLYCDFGHJKMPRVWXZQUESTXON 

BLYCDFGHJKMPRVWXZQUESTIONA 

LYCDFGHJKMPRVWXZQUESTIONAB 

YCDFGHJKMPRVWXZQUESTIONABL 

CDFGHJKMPRVWXZQUESTIONABLY 

DFGHJKMPRVWXZQUESTIONABLYC 

FGHJKMPRVWXZQUESTIONABLYCD 

GHJKMPRVWXZQUESTIONABLYCDF 

HJKMPRVWXZQUESTIONABLYCDFG 

JKMPRVWXZQUESTIONABLYCDFGH 

KMPRVWXZQUESTIONABLYCDFGHJ 

MPRVWXZQUESTIONABLYCDFGHJK 

PRVWXZQUESTIONABLYCDFGHJKM 

RVWXZQUESTIONABLYCDFGHJKMP 

VWXZQUESTIONABLYCDFGHJKMPR 

WXZQUESTIONABLYCDFGHJKMPRV 

XZQUESTIONABLYCDFGHJKMPRVW 

ZQUESTIONABLYCDFGHJKMPRVWX 

Fiona* 21. 

29. Cryptographing and decryptographing by identical primary mixed components. — There 
is nothing of special interest to be noted in connection with the use either of identical mixed 
components or of an equivalent quadricular table such as that shown in Fig. 21, in enciphering or 
deciphering a message. The basic principles are the same as in the case of the sliding of one 
mixed component against the normal, the displacements of the two components being controlled 
by changeable key words of varying lengths. The components may be changed at will and so on. 
All this has been demonstrated adequately enough in Elementary Military Cryptography, and 
Advanced Military Cryptography . 

30. Principles of solution. — a. Basically the principles of solution in the case of a crypto- 
gram enciphered by two identical mixed sliding components are the same as in the preceding 
case. Primary recourse is had to the principles of frequency and repetition of single letters, 
digraphs, trigraphs, and polygraphs. Once an entering wedge has been forced into the problem, 
the subsequent steps may consist merely in continuing along the same lines as before, building 
up the solution bit by bit. 

b. Doubtless the question has already arisen in the student’s mind as to whether any 
principles of symmetery of position can be used to assist in the solution and in the reconstruction 
of the cipher alphabets in cases of the kind under consideration. This phase of the subject will 
be taken up in the next section and will be treated in a somewhat detailed manner, because the 
theory and principles involved are of very wide application in cryptanalytics. 
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Section VII 

THEORY OF INDIRECT SYMMETRY OF POSITION IN SECONDARY ALPHABETS 

Paragraph 

Reconstruction of primary components from secondary alphabets 31 

31. Reconstruction of primary components from secondary alphabets. — a. Note the two 
secondary alphabets (1) and (2) given in paragraph 28c. Externally they show no resemblance 
or symmetry despite the fact that they were produced from the same primary components. 
Nevertheless, when the matter is studied with care, a symmetry of position is discoverable. 
Because it is a hidden or latent phenomenon, it may be termed latent symmetry oj position. 
However, in previous texts the phenomenon has been designated as an indirect symmetry opposition 
and this terminology has grown into usage, so that a change is perhaps now inadvisable. 
Indirect symmetry of position is a very interesting and exceedingly useful phenomenon in 
cryptanalytics. 

b. Consider the following secondary alphabet (the one labeled (2) in paragraph 28c): 

m f Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

W (Cipher J K R V Y W X ZFQUMEHGSBTCDLIONPA 

c. Assuming it to be known that this is a secondary alphabet produced by two primary 
identical mixed components, it is desired to reconstruct the latter. Construct a chain of alter- 
nating plain-text and cipher-text equivalents, beginning at any point and continuing until the 
chain has been completed. Thus, for example, beginning with Ap= J 0 , J p =Q e , Q D — B„, . . ., and 
dropping out the letters common to successive pairs, there results the sequence A J Q B . . .. By 
completing the chain the following sequence of letters is established: 

AJQBKULMEYPSCRTDVIFWOG X N H Z 

d. This sequence consists of 26 letters. When slid against itself it will produce exactly the 
same secondary alphabets as do the primary components based upon the word QUESTIONABLY. 
To demonstrate that this is the case, compare the secondary alphabets given by the two settings 
of the externally different components shown below: 

Plain component QUESTIONABLYCDFGHJKMPRVWXZQUESTIONABLYCDFGHJKMPRVWXZ 

Cipher component. QUESTIONABLY CDFGHJKMPRVWXZ 

Secondary alphabet (1): 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher. JKRVYWXZFQUMEHGSBTCDLIONPA 

Plain component AJQBKULMEYPSCRTDVIFWOGXNHZAJQBKULMEYPSCRTDVIFWOGXNHZ 

Cipher component. AJ QBKULMEYPSCRTDVIFWOGXNHZ 

Secondary alphabet (2): 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher JKRVYWXZFQUMEHGSBTCDLIONPA 

(52) 
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«. Since the sequence A J Q B K . . . gives exactly the same equivalents in the secondary 
alphabets as the sequence QUEST. . . gives, the former sequence is cryptographically 
equivalent to the latter sequence. For this reason the A J Q B K . . . sequence is termed 
an equivalent primary component. 1 If the real or original primary component is a key-word mixed 
sequence, it is hidden or latent within the equivalent primary sequence; but it can be made patent 
by decimation of the equivalent primary component. The procedure is as follows: Find three 
letters in the equivalent primary component such as are likely to have formed an unbroken 
sequence in the original primary component, and see if the interval between the first and second 
is the same as that between the second and third. Such a case is presented by the letters W, X, 
and Z in the equivalent primary component above. Note the sequence . . . WOGXNHZ. . . ; 
the distance or interval between the letters W, X, and Z is two letters. Continuing the chain by 
adding letters two intervals removed, the latent original primary component is made patent. 
Thus: 



1 2 3 4 J « 7 8 # 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 M 

WXZQUESTIONABLYCDFGHJKMPRV 

/. It is possible to perform the steps given in c and e in a combined single operation when the 
original primary component is a key-word mixed sequence. Starting with any pairof letters (in 
the cipher component of the secondary alphabet) likely to be sequent in the key-word mixed 
sequence, such as JK„ in the secondary alphabet labeled (2), the following chain of digraphs may 
be set up. Thus, J,K, in the plain component stand over Q,U, respectively, in the cipher com- 
ponent ; Q,U, in the plain component stand over B , L , respectively, in the cipher component, and 
so on. Connecting the pairs in a series, the following results are obtained: 

JK QU -> BL -» KM -> UE -» LY -> MP -> ES YC -> PR -> ST -> CD -> RV -» 

TI -» DF -» VW -* 10 -> FG -> WX -> ON GH XZ -> NA -> HJ ZQ -> AB JK . . . 

These may now be united by means of their common letters: 

JK -» KM MP -> PR -» RV -♦ etc.=J KMPRVWXZQUESTIONABLYCDFGH 

The original primary component is thus completely reconstructed. 

g. Not all of the 26 secondary alphabets of the series yielded by two sliding primary compo- 
nents may be used to develop a complete equivalent primary component. If examination be made, 
it will be found that only 13 of these secondary alphabets will yield complete equivalent primary 
components when the method of reconstruction shown in subparagraph c above is followed. For 
example the following secondary alphabet, which is also derived, from the primary components 
based upon the word QUESTIONABLY will not yield a complete chain of 26 plain text-cipher- 
plain text equivalents: 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher. CDHJOKMPBRVFWYLXTZNAIQUEGS 



1 Such an equivalent component is merely a sequence which has been or can be developed or derived from 
the original sequence or basic primary component by applying a decimation process to the latter; conversely, 
the original or basic component can be derived from an equivalent component by applying the same sort of 
process to the equivalent component. By decimation is meant the selection of elements from a sequence accord- 
ing to some fixed interval. For example, the sequence A E I M . . .is derived, by decimation, from the 
normal alphabet by selecting every fourth letter, 
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Equivalent primary component: 

1 2 8 4 6 6 7 8 9 10 11 12 13 |l 2 3 

ACHPXEOLFKVQTlACH. . . (The A C H sequence begins again.) 

h. It is seen that only 13 letters of the chain have been established before the sequence begins 
to repeat itself. It is evident that exactly one-half of the chain has been established. The other 
half may be established by beginning with a letter not in the first half. Thus: 

Z 2 8 4 6 6 7 8 9 10 11 12 13 12 8 

BDJRZSNYGMWUI BDJ... (The B D J sequence begins again.) 

i. It is now necessary to distribute the letters of each half-sequence within 26 spaces, to 
correspond with their placements in a complete alphabet. This can only be done by allowing a 
constant odd number of spaces between the letters of one of the half-sequences. Distributions 
are therefore made upon the basis of 3, 5, 7, 9, . . . spaces. Select that distribution which 
most nearly coincides with the distribution to be expected in a key-word component. Thus, for 
example, with the first half-sequence the distribution selected is the one made by leaving three 
spaces between the letters. It is as follows: 

1 2 8 4 8 8 7 8 9 10 11 12 18 14 IS 16 17 18 19 20 21 22 23 24 28 28 

A — L — C-F-H-K — P — V — X-Q-E-T-0 — 

j. Now interpolate, by the same constant interval (three in this case), the letters of the other 
half-sequence. Noting that the group F - H appears in the foregoing distribution, it is apparent 
that G of the second half-sequence should be inserted between F and H. The letter which imme- 
diately follows G in the second half-sequence, viz, M, is next inserted in the position three spaces to 
the right of G, and so on, until the interpolation has been completed. This yields the original 
primary component, which is as follows: 

1 2 3 4 8 8 7 8 9 10 11 12 13 14 18 18 17 18 19 20 21 22 23 24 28 28 

ABLYCDFGHJKMPRVWXZQUESTION 

k. Another method of handling cases such as the foregoing is indicated in subparagraph j 
By extending the principles set forth in that subparagraph, one may reconstruct the following 
chain of 13 pairs from the secondary alphabet given in subparagraph g: 

1 2 3 4 5 8 7 8 9 10 11 12 13 I 1 

CD -+ HJ -> PR -» XZ -> ES -> ON -> LY -> FG -» KM -> VW -> QU -> TI -» AB |-» CD . . . 

Now find, in the foregoing chain, two pairs likely to be sequent, for example HJ and KM and count 
the interval between them in the chain. It is 7 (counting by pairs). If this decimation interval 
is now applied to the chain of pairs, the following is established: 

1 2 8 4 8 8 7 8 9 10 11 12 13 14 16 16 17 18 19 20 21 22 28 24 28 28 

HJKMPRVWXZQUESTIONABLYCDFG 

l. The reason why a complete chain of 26 letters cannot be constructed from the secondary 
alphabet given under subparagraph g is that it represents a case in which two primary com- 
ponents of 26 letters were slid an even number of intervals apart. (This will be explained in 
further detail in subparagraph r below.) There are in all 12 such cases, none of which will 
admit of the construction of a complete chain of 26 letters. In addition, there is one case where- 
in, despite the fact that the primary components are an odd number of intervals apart, the 
secondary alphabet cannot be made to yield a complete chain of 26 letters for an equivalent 
primary component. This is the case in which the displacement is 13 intervals. Note the 
secondary alphabet based upon the primary components below (which are the same as those 
shown in subparagraph d): 
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Primary Components 

QUESTIONABLYCDFGHJKMPRVWXZ 

DFGHJKMPRVWXZQUESTIONABLYC 

Secondary Alphabet 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher. RVZQGUESKTIWOPMNDAHJFBLYXC 

m. If an attempt is made to construct a chain of letters from this secondary alphabet alone, 
no progress can be made because the alphabet is completely reciprocal. However, the crypt, 
analyst need not at all be baffled by this case. The attack will follow along the lines shown below 
in subparagraphs n and o. 

n. If the original primary component is a key-word mixed sequence, the cryptanalyst may 
reconstruct it by attempting to “dovetail” the 13 reciprocal pairs (AR,BV, CZ,DQ,EG,FU,HS, 
IK, JT,LW,M0,NP, and XY) into one sequence. The members of these pairs are all 13 intervals 
apart. Thus: 

11334(6788 10 11 13 13 

A R 



Write out the series of numbers from 1 to 26 and insert as many pairs into position as possible, 
being guided by considerations of probable partial sequences in the key-word mixed sequence, 
Thus: 

0 1 3 8 4 6 « 7 8 9 10 11 13 13 14 16 18 

ABCD RVZQ 

It begins to look as though the key-word commences with the letter Q, in which case it should 
be followed by U. This means that the next pair to be inserted is FU. Thus: 

0 1 2 8 4 5 6 7 8 9 10 11 13 13 14 IS 18 17 

ABCDF RVZQU 

The sequence ABCDF means that E is in the key. Perhaps the sequence is A B C D F G H. 
Upon trial, using the pairs EG and HS, the following placements are obtained: 

0 1 2 3 4 8 B 7 8 9 10 11 12 13 14 18 18 17 18 19 

ABCDFGH RVZQUES 

This suggests the word QUEST or QUESTION. The pair JT is added: 

0 1 2 8 4 6 0 7 8 9 10 11 13 IS 14 IS 16 17 18 19 20 

ABCDFGHJ RVZQUEST 
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The sequence G H J suggests G H J K, which places an I after T. Enough of the process has 
been shown to make the steps clear. 

o. Another method of circumventing the difficulties introduced by the 14th secondary 
alphabet (displacement interval, 13) is to use it in conjunction with another secondary alphabet 
which is produced by an even-interval displacement. For example, suppose the following two 
secondaiy alphabets are available. 1 

0 ABCDEFGHI JKLMNOPQRSTUVBXYZ 

1........ RVZQGUESKTIWOPMNDAHJFBLYXC 

2 XZESKTIORNAQBWVLHYMPJCDFUG 

Fiqvhe 23. 

The first of these secondaries is the 13-interval secondary; the second is one of the even- 
interval secondaries, from which only half-chain sequences can be constructed. But if the con- 
struction be based upon the two sequences, 1 and 2 in the foregoing diagram, the following is 
obtained: 

RXUTNLDHMVZEIAYFJPWQSOBCGK 

This is a complete equivalent primary component. The original key-word mixed component 
can be recovered from it by decimation based upon the 9th interval: 

RVffXZQUESTIONABLYCDFGHJKMP 

p. (1) When the primary components are identical mixed sequences proceeding in opposite 
directions, all the secondary alphabets will be reciprocal alphabets. Reconstruction of the 
primary component can be accomplished by the procedure indicated under subparagraph o 
above. Note the following three reciprocal secondary alphabets: 

1 2 8 4 5 6 7 8 B 10 11 12 13 14 18 16 17 18 10 20 21 22 28 24 28 26 

0 -. ABCDEFGHI JKLMNOPQRSTUVWXYZ 

1.. .. PMHGQFDCWYLKBRVAENZXUOITJS 

2.. .. WVMKSJHGQFDRCXZYILEUTBANPO 

3.. .. TSSZLXWVNRPEMIOKCJBAYHGFUD 

Figueu 24. 

(2) Using lines 1 and 2, the following chain can be constructed (equivalent primary com- 
ponent): 

PWQSOBCGKRXUTNLDHMVZEIATFJ 

1 The method of writing down the secondaries shown in figure 23 will hereafter be followed in all cases when 
alphabet reconstruction skeletons are necessary. The top line will be understood to be the plain component; it 
is common to all the secondary alphabets, and is set off from the cipher components by the heavy black line. 
This top line of letters will be designated by the digit 0, and will be referred to as “the zero line” in the diagram. 
The successive lines of letters, which occupy the space below the zero line and which contain the various cipher 
components of the several secondary alphabets, will be numbered serially. These numbers may then be used as 
reference numbers for designating the horizontal lines in the diagram. The numbers standing above the letters 
may be used as reference numbers for the vertical columns in the diagram. Hence, any letter in the reconstruc- 
tion skeleton may be designated by coordinates, giving the horizontal or X coordinate first. Thus, D (2-11) 
means the letter D standing in line 2, Column 11. 
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Or, using lines 2 and 3: 

WTYKZODPUAGVSLJXICMQNFREBH 

The original key-word mixed primary component (based on the word QUESTIONABLY) can 
be recovered from either of the two foregoing equivalent primary components. But if lines 1 
and 3 are used, only half-chains can be constructed: 

PTFXAKECVOHQL and MSDWNJUYRIGZB 

This is because 1 and 3 are both odd-interval secondary alphabets, whereas 2 is an even- 
interval secondary. It may be added that odd-interval secondaries are characterized by having 
two cases in which a plain-text letter is enciphered by itself; that is, 6 p is identical with 0 a . 
This phrase “identical with” will be represented by the symbol m ; the phrase “not identical 
with” will be represented by the symbol fk . (Note that in secondary alphabet number 1 above, 
F d =F„ and U„ssU a ; in secondary alphabet number 3 above, M p =M a and O p sQ 0 ). This charac- 
teristic will enable the ciyptanalyst to select at once the proper two secondaries to work with in 
case several are available; one should show two cases where 0 D =0 a ; the other should show 
none. 

q. (1) When the primary components are different mixed sequences, their reconstruction 
from secondary cipher alphabets follows along the same lines as set forth above, under b to j, 
inclusive, with the exception that the selection of letters for building up the chain of equivalents 
for the primary cipher component is restricted to those below the zero line in the reconstruction 
skeleton. Having reconstructed the primary cipher component, the plain component can be 
readily reconstructed. This will become clear if the student will study the following example. 

0 ABCDEFGHIJKLMNOPQRSTUVWXYZ 

1_ TVABULIQXYCWSNDPFEZGRHJKMO 
2 ZJSTVIQRMONKXEAGBWPLHYCDFU 

Figube 35 . 

(2) Using only lines 1 and 2, the following chain is constructed: 

TZPGLIQRHYOUVJ CNEWKDASXMFB 

This is an equivalent primary cipher component. By finding the values of the successive 
letters of this chain in terms of the plain component of secondary alphabet number 1 (the zero 
line), the following is obtained: 

TZPGLIQRHYOUVJ CNEWKDASXMFB 
ASPTFGHUVJZEBWKNRLXOCMIYQD 

The sequence A S P T . . . is an equivalent primary plain component. The original key- 
word mixed components may be recovered from each of the equivalent primary components. 
That for the primary plain component is based upon the key PUBLISHERS MAGAZINE; that for 
the primary cipher component is based upon the key QUESTIONABLY. 
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(3) An other method of accomplishing the process indicated above can be illustrated graphi- 
cally by the following two chains, based upon the two secondary alphabets set forth in sub- 
paragraph 2 (1): 

1 3 3 4 8 8 7 8 9 10 11 12 13 14 18 16 17 18 19 20 21 22 23 24 25 28 

0 ABCDEFGHI JKLMNOPQRSTUVWXYZ 

1 TVABULIQXYCWSNDPFEZGRHJKMO 

2 ZJSTVIQRMONKXEAGBWPLHYCDFU 



Coll. 

A (0-1) 


— > 


Col. 2. 

T (1-1); 




T (2-4) -* 


D (0-4); 




D (0-4) 




B (1-4); 


— > 


B (2-17) -> 


Q (0-17); 




Q (0-17) 


-> 


F (1-17); 


— > 


F (2-25) -*• 


Y (0-25); 


— > 


Y (0-25) 




M (1-25); 




M (2-9) 


I (0-9); 


— > 


I (0-9) 


-* 


X (1-9); 




X (2-13) -* 


M (0-13); 


-» 


M (0-13) 


— > 


S (1-13); 




S (2-3) 


C (0-3); 


— 


etc. 




etc. 

FlOUSZ 28. 







(4) By joining the letters in Column 1, the following chain is obtained: A D Q Y I M, etc. 
If this be examined, it will be found to be an equivalent primary of the sequence based upon 
PUBLISHERS MAGAZINE . By joining the letters in Column 2, the following chain is obtained: 
T B F M X S. This is an equivalent primary of the sequence based upon QUESTIONABLY. 

r. A final word concerning the reconstruction of primary components in general may be 
added. It has been seen that in the case of a 26-element component sliding against itself (both 
components proceeding in the same direction), it is only the secondary alphabets resulting from 
odd-interval displacements of the primary components which permit of reconstructing a single 
26-letter chain of equivalents. This is true except for the 13th interval displacement, which 
even though an odd number, still acts like an even number displacement in that no complete 
chain of equivalents can be established from the secondary alphabet. This exception gives the 
clue to the basic reason for this phenomenon: it is that the number 26 has two factors, 2 and 13, 
which enter into the picture. With the exception of displacement-interval 1 , any displacement 
interval which is a sub-multiple of, or has a factor in common with the number of letters in the primary 
sequence will yield a secondary alphabet from which no complete chain of 26 equivalents can be 
derived for the construction of a complete equivalent primary component. This general rule is 
applicable only to components which progress in the same direction; if they progress in opposite 
directions, all the secondary alphabets are reciprocal alphabets and they behave exactly like 
the reciprocal secondaries resulting from the 13-interval displacement of two 26-letter identical 
components progressing in the same direction. 

a. The foregoing remarks give rise to the following observations based upon the general 
rule pointed out above. Whether or not a complete equivalent primary component is derivable 
by decimation from an original primary component (and if not, the lengths and numbers of chains 
of letters, or incomplete components, that can be constructed in attempts to derive such equiv- 
alent components) will depend upon the number of letters in the original primary component 
and the specific decimation interval selected. For example, in a 26-letter original primary com- 
ponent, decimation interval 6 will yield a complete equivalent primary component of 26 letters, 
whereas decimation intervals 4 or 8 will yield 2 chains of 13 letters each. In a 24-letter compo- 
nent, decimation interval 5 will also yield a complete equivalent primary component (of 24 letters), 
but decimation interval 4 will yield 6 chains of 4 letters each, and decimation interval 8 will 
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yield 3 chains of 8 letters each. It also follows that in the case of an original primary com- 
ponent in which the total number of characters is a prime number, all decimation intervals will 
yield complete equivalent primary components. The following table has been drawn up in the 
light of these observations, for original primary sequences from 16 to 32 elements. (All prime- 
number sequences have been omitted.) In this table, the column at the extreme left gives the 
various decimation intervals, omitting in each case the first interval, which merely gives the 
original primary sequence, and the last interval, which merely gives the original sequence 
reversed. The top line of the table gives the various lengths of original primary sequences from 
32 down to 16. (The student should bear in mind that sequences containing characters in addi- 
tion to the letters of the alphabet may be encountered; he can add to this table when he is 
interested in sequences of more than 32 characters.) The numbers within the table then show, 
for each combination of decimation interval and length of, original sequence, the lengths of the 
chains of characters that can be constructed. (The student may note the symmetry in each 
column.) The bottom line shows the total number of complete equivalent primary components 
which can be derived for each different length of original component. 



Decimation 

interval 


32 


30 


Number of characters In original primary' component 

28 27 26 25 24 22 21 20 


18 


_16 


2 


16 


15 


14 


27 


13 


25 


12 


11 


21 


10 


9 


8 
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32 


10 
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26 


25 


8 


22 
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20 
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16 
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8 


15 
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6 
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27 
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24 


22 


21 


4 


18 


16 


6 


16 


5 


14 


9 


13 


25 


4 


11 


7 


10 


3 


8 


7 


32 


30 


4 


27 


26 


25 


24 


22 


3 


20 


18 


16 


8 


4 


15 


7 


27 


13 


25 


6 


11 


21 


5 


9 


2 


9 


32 


10 


28 


9 


26 


25 


8 


22 


7 


20 


2 


16 


10 


16 


3 


14 


27 


13 


5 


12 


11 


21 


2 


9 


8 


11 


32 


30 


28 


27 


26 


25 


24 


2 


21 


20 


18 


16 


12 


8 


5 


7 


9 


13 


25 


2 


11 


7 


5 


3 


4 


13 


32 


30 


28 


27 


2 


25 


24 


22 


21 


20 


18 


16 


14 


16 


15 


2 


27 


13 


25 


12 


11 


3 


10 


9 


8 


15 


32 


2 


28 


9 


26 


5 


8 


22 


7 


4 


6 




16 


2 


15 


7 


27 


13 


25 


6 


11 


21 


5 


9 




17 


32 


30 


28 


27 


26 


25 


24 


22 


21 


20 






18 


16 


5 


14 


9 


13 


25 


4 


11 


7 


10 






19 


32 


30 


28 


27 


26 


25 


24 


22 


21 








20 


8 


3 


7 


27 


13 


5 


6 


11 










21 


32 


10 


4 


9 


26 


25 


8 












22 


16 


15 


14 


27 


13 


25 


12 












23 


32 


30 


28 


27 


26 


25 














24 


4 


5 


7 


9 


13 
















25 


32 


6 


28 


27 


















26 


16 


15 


14 




















27 


32 


10 






















28 


8 


15 






















29 


32 
























30 


16 
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Section VIII 

APPLICATION OF PRINCIPLES OF INDIRECT SYMMETRY OF POSITION 



Applying the principles to a specific example 
The cryptogram employed in the exposition. 

Fundamental theory 

Application of principles 

General remarks 



Paragraph 

32 

33 

34 

35 

36 



32. Applying the principles to a specific example. — a. The preceding section, with the 
many details covered, now forms a sufficient base for proceeding with an exposition of how the 
principles of indirect symmetry of position can be applied very early in the solution of a poly- 
alphabetic substitution cipher in which sliding primary components were employed to produce 
the secondary cipher alphabets for the enciphering of the cryptogram. 

6. The case described below will serve not only to explain the method of applying these 
principles but will at the same time show how their application greatly facilitates the solution 
of a single, rather difficult, polyalphabetic substitution cipher. It is realized, of course, that the 
cryptogram could be solved by the usual methods of frequency and long, patient experimentation. 
However, the method to be described was actually applied and very materially reduced the 
amount of time and labor that would otherwise have been required for solution. 

33. The cryptogram employed in the exposition. — a. The problem that will be used in this 
exposition involves an actual cryptogram submitted for solution in connection with a cipher 
device having two concentric disks upon which the same random mixed alphabet appears, both 
alphabets progressing in the same direction. This was obtained from a study of the descriptive 
circular accompanying the cryptogram. By the usual process of factoring, it was determined 
that the cryptogram involved 10 alphabets. The message as arranged according to its period 
is shown in Figure 27, in which all repetitions of two or more letters are indicated. 

b. The triliteral frequency distributions are given in Figure 28. It will be seen that on 
account of the brevity of the message, considering the number of alphabets involved, the fre- 
quency distributions do not yield many clues. By a very careful study of the repetitions, 
tentative individual determinations of values of cipher letters, as illustrated in Figures 29, 30, 
31, and 32, were made. These are given in sequence and in detail in order to show that there is 
nothing artificial or arbitrary in the preliminary stages of analysis here set forth. 

( 60 ) 
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123456789 10 

A ffFUPCFOCJY 
B GBZDPFB OJJ 0 
C GRFTZMOM AV 
D K Z UGD Y F T R W 
E jG JXNLW YOU X 
F I K W E PQZOKZ 
G PRXJDWLZI C_J_ 
H _ _G K Q H 0 L 0 D V M 
I GOXSNZHASE 
J BBJIPQFJHD 
K QCBZEXQTXZ 
L J CQRQFVMLH 
M S R Q E W M LHAE 
N G S X E R 0 Z J S E 
0 JT.QWE JHKGH 



61 

The Cbyptogram 
(R epetitions underlined) 

123456789 10 

P R C V 0 P N B L C ff 
Q LQ. ZAAAMDCH 
R BZZCKQOIKF_ 
S _C F B S C V XjC H Q 
T ZTZSDMXWCM 
U RKUHEQEDGX 

V FKVHPJJKJY 

ff Y Q D P C J X L L L 

X G H X E R 0 Q P S E 

Y _G K BWTLFDUZ 
Z OCDHWMZTUZ 

AA K L B P C J 0 T X E 

BB H S P 0 P N M D L M 

CC_GCKWDVB_L S E 
DD _G S U G D P 0 T H X 

Figube 27 . 



123456789 10 

EE BKDZFMTGQJ 
FF LFJJYDTZV H Q 
GG_ZGWNKXJ T_R N_ 
HH YTXCDPMVLW 
II BGBWffOORGN 
JJ HHVLAQQ. VAV 
KK JQWOOTTNVQ 
LL B_K X_D S 0_Z R S N_ 
MM YUXOPPYO X Z . 
NN JOZO ff M X C G Q 
00 J J U G D ff Q R V M 
PP U O PEFXENF, 
QQ _C C U G D ff P E U H 
RR Y B ff E W V M__D W J 
SS R Z X 



162018—38 6 
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Tbiliteral Frequency Distributions 
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Figube 28. 
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Initial Values From Assumptions 

12 3 5 

Go=Epj K C =E P ; X 0 =E B ; and D 0 =E B , from frequency considerations. 

345 455 901 

UGD=THE; PCJ=THE; and SEG=THE, from study of repetitions. 
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Additional Values from Assumptions (I) 

2 

Refer to line DD in Figure 29; S 8 assumed to be N p . 

9 

Refer to line M in figure 29 ; A, assumed to be W D . 

9 10 1 2 3 4 « 

Then in lines C-D, AVKZUGD is assumed to be WITH THE. 
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Additional Values prom Assumptions (II) 

123 4 3 6 7 8 9 10 

Refer to Figure 30, line AjWFUPCFOCJY; assume to be BUT THOUGH. 

T T H 

8 4 3 6 

Refer to Figure 30, lines N and X, where repetition X E R 0 occurs; assume EACH 
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Additional Values Fbom Assumptions (III) 

4 5 « 

OPN — assume ING from repetition and frequency. 

9 0 1 

HQZ — assume ING from repetition and frequency. 
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c. From the initial and subsequent tentative identifications shown in Figures 29, 30, 31, 
and 32, the values obtained were arranged in the form of the secondary alphabets in a reconstruc- 
tion skeleton, shown in Figure 33. 
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34. Fundamental theory. — a. In paragraph 31, methods of reconstructing primary com- 
ponents from secondary alphabets were given in detail. It is necessary that those methods be 
fully understood before the following steps be studied. It was there shown that the primary 
component can be one of a series of equivalent primary sequences, all of which will give exactly 
similar results so far as the secondary alphabets and the cryptographic text are concerned. 
It is not necessary that the identical or original primary component employed in the crypto- 
graphing be reconstructed; any equivalent primary sequence will serve. The whole question is 
one of establishing a sequence of letters the interval between which is either identical with that 
in the original primary component or else is an exact constant multiple of the interval separating 
the letters in the original primary component. For example, suppose K P X N Q forms a 
sequence in the original primary component. Here the interval between K and P, and P and X, 
X and N, N and Q is one; in an equivalent primary component, say the sequence K . . P . . X 
. . N . . Q, the interval between K and P is three, that between P and X also three, and so on; 
and the two sequences will yield the same secondary alphabets. So long as the interval between 
K and P, P and X, X and N, N and Q, . . . , is a constant one, the sequence will be cryptographically 
equivalent to the original primary sequence and will yield the same secondary alphabets as do 
those of the original primary sequence. However, in the case of a 26-letter component, it is 
necessary that this interval be an odd number other than 13, as these are the only cases which 
will yield one unbroken sequence of 26 letters. Suppose a secondary alphabet to be as follows: 



( 1 ) 



[Plain... 

[Cipher. 



ABCPEFGHI JKLMNOPQRSTUVffXYZ 

X K N P 
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It can be said that the primary component contains the following sequences: 



XN HP NQ PX 

These, when united by means of their common letters, yield K P X N Q. 
Suppose also the following secondary alphabet is at hand: 



( 2 ) 



[Plain... 

[Cipher. 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 

P X K N 



Here the sequences PN, XQ, KX, and NZ can be obtained, which when united yield the two se- 
quences KXQ and PNZ. 

By a comparison of the sequences K P X N Q, K X Q, and PNZ, one can establish the 
following: 

K P X N Q 

K . X . Q 

P . N . Z 



It follows that one can now add the letter Z to the sequence, making it K P X N Q Z. 

b. The reconstruction of a primary component from one of the secondary alphabets by the 
process given in paragraph 31 requires a complete or nearly complete secondary alphabet. 
This is at hand only after a cryptogram has been completely solved. But if one could employ 
several very scant or skeletonized secondary alphabets simultaneously with the analysis of the 
cryptogram, one could then possibly build up a primary component from fewer data and thus 
solve the cryptogram much more rapidly than would otherwise be possible. 

c. Suppose only the cipher components of the two secondary alphabets (1) and (2) given 
above be placed into juxtaposition. Thus: 



1 2 3 4 S 6 7 8 9 10 11 12 13 14 15 16 17 18 IS 20 21 22 23 24 28 26 



(1) X . K N P . . 

(2) P . . X K . N 



The sequences PX, XN, and KP are given by juxtaposition. These, when united, yield KPXN 
as part of the primary sequence. It follows, therefore, that one can employ the cipher components 
of secondary alphabets as sources of independent data to assist in building up the primary sequences. 
The usefulness of this point will become clearer subsequently. 

35. Application of principles. — a. Refer now to the reconstruction skeleton shown in 
Figure 33. Hereafter, in order to avoid all ambiguity and for ease in reference, the position of 
a letter in Figure 33 will be indicated as stated in footnote 1, page 56. Thus, N (6-7) refers to 
the letter N in line 6 and in col umn 7 of Figure 33. 
b. (1) Now, consider the following pairs of letters: 



E (0-5) 
G (0-7) 
|H (0-8) 
10 (0-15) 



J (6-5) 

N (6-7) 

0 ( 6 - 8 ) 1 
F (6-15)} 



HO, 0F=H0F 



(One is able to use the line marked zero in Figure 33 since this is a mixed sequence sliding against 
itself.) 
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(2) The immediate results of this set of values will now be given. Having HOF as a sequence, 
with EJ as belonging to the same displacement interval, suppose HOF and EJ are placed into 
juxtaposition as portions of sliding components. Thus: 

Plain HOF. . . 

Cipher. E J . . . . 

When H p =E ej then 0 P = J e . 

(3) Refer now to alphabet 10, Figure 33, where it is seen that H p =E e . The derived value, 
0„= J„, can immediately he inserted in the same alphabet and substituted in the cryptogram. 

(4) The student may possibly get a clearer idea of the principles involved if he will regard 
the matter as though he were dealing with arithmetical proportion. For instance, given any 
three terms in the proportion 2:8=4 : 16, the 4th term can easily be found. Furthermore, given 
the pair of values on the left-hand side of the equation, one may find numerous pairs of 
values which may be inserted in the right-hand side, or vice versa. For instance, 2:8=4:16 
is the same as 2:8=5:20, or 9:36=4:16, and so on. An illustration of each of these principles 
will now be given, reference being mado to Figure 33. As an example of the first principle, note 
that E (0-5) :H (0-8) =J (6-5):0 (6-8). Now find E (10-8):H (0-8)=? (10-15) :0 (0-15). 
It is clear that J may be inserted as the 3d term in this proportion, thus giving the 

i° 

important new value, 0 P = J„, which is exactly what was obtained directly above, by means of 
the partial sliding components. As an example of the second principle, note the following pairs: 

E (0-5) H (0-8) 

K (2-5) Z (2-8) 

D (5-5) C (5-8) 

J (6-5) 0 (6-8) 

These additional pairs are also noted: 

K (1-20) Z (1-7) 

T (0-20) G (0-7) 

Therefore, E:H=K:Z=D:C= J:0=T:G, and T may be inserted in position (4-5). 

c. (1) Again, GN belongs to the same set of displacement-interval values as do EJ and HOF. 
Hence, by superimposition: 

Plain HOF. . . 

Cipher . . . G N . . . . 

(2) Referring to alphabet 4, when H P =G„, then 0 P =N„. Therefore, the letter N can be inserted 

4 

in position (4-15) in Figure 33, and the value N C =0 P can be substituted in the cryptogram. 

(3) Furthermore, note the corroboration found from this particular superimposition: 

H (0-8) G (0-7) 

0 (6-8) N (6-7) 

This checks up the value in alphabet 6, G p =N e . 

d. (1) Again superimpose HOF and GN: 

. . .HOF. . . 

.... G N ... 

(2) Note this corroboration: 

0 (6-8) G (4-8) 

F (6-15) N (4-15) 

which has just been inserted in Figure 33, as stated above. 
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e. (1) Again using HOF and EJ, but in a different superimposition: 

. . .HOF. . 

..EJ.... 

(2) Refer now to H (9-9), J (9-8). Directly under these letters is found V (10-9), E (10-8). 

Therefore, the V can be added immediately before HOF, making the sequence V H 0 F. 

/. (1) Now take V H 0 F and juxtapose it with E J, thus: 

. . . V H 0 F . . . 

. . . E J . . . 

(2) Refer now to Figure 33, and find the following: 

V (10-9) E (10-8) 

H (9-9) J (9-8) 

0 (4-9) G (4-8) 

1 (0-9) H (0-8) 

(3) From the value 0 G it follows that G can be set next to J in E J. Thus: 

. . . V H 0 F . . . 

• . . E J G . . . 

(4) But G N already is known to belong to the same set of displacement-interval values 
as E J. Therefore, it is now possible to combine E J, J G, and G N into one sequence, E J G N, 
yielding: 

. . . V H 0 F . . . 

. . . E J G N . . . 

g. (1) Refer now to Figure 33. 

V (£-22) E (0-5) 

? (1-22) G (1-5) 

? (2-22) K (2-5) 

? (3-22) X (3-5) 

? (5-22) D (5-5) 

? (6-22) J (6-5) 

(2) The only values which can be inserted are: 

0 (1-22) G (1-5) 

H (6-22) J (6-5) 

(3) This means that V p =0 o in alphabet 1 and that V„=H C in alphabet 6. There is one 0. 
in the frequency distribution for alphabet 1, and no H„ in that for alphabet 6. The frequency 
distribution is, therefore, corroborative insofar as these values are concerned. 

(A) (1) Further, taking E J G N and V H 0 F, superimpose them thus: 

. . . E J G N . . . 

. . . V H 0 F . . . 

(2) Refer now to Figure 33. 

E (0-5) H (0-8) 

G (1-5) ? (1-8) 



REF ID:A64565 



72 

(3) From the diagram of superimposition the value G (1-5) F (1-8) can be inserted, which 
gives H p =F e in alphabet 1. 

i. (1) Again, V H 0 F and E J G N are juxtaposed: 

. . . V H 0 F . . . 

• • . E J G N . . . 

(2) Refer to Figure 33 and find the following: 

H (0-8) G (4-8) 

A (0-1) E (4-1) 

This means that it is possible to add A, thus: 

. . . A V H 0 F . . . 

. . . E J G N . . . 

(3) In the set there are also: 

E (0-5) G (1-5) 

G (0-7) Z (1-7) 

Then in the superimposition 

. . . E J G N . . . 

. . . E J G N . 

It is possible to add Z under G, making the sequence E J G N Z. 

(4) Then taking 

. . . A V H 0 F . . . 

. . i E J G N Z i • « 

and referring to Figure 33: 

H (0-8) N (0-14) 

0 (6-8) ? (6-14) 

It will be seen that 0=Z from superimposition, and hence in alphabet 6 N P =Z C , an important 
new value, but occurring only once in the cryptogram. Has an error been made? The work 
so far seems too corroborative in interlocking details to think so. 

j. (1) The possibilities of the superimposition and sliding of the AVHOF and the EJGNZ 
sequences have by no means been exhausted as yet, but a little different trail this time may 
be advisable. 

E (0-5) T (0-20) 

G (1-5) K (1-20) 

K (3-5) U (3-20) 

(2) Then: 

• . .EJGNZ. • • 

...T.K... 

(3) Now refer to the following: 

E (0-5) K (2-5) 

N (0-14) S (2-14) 
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whereupon the value S can be inserted: 

. . . E J G N Z . . . 

- . . . T . K . . S . . . 

k. (1) Consider all the values based upon the displacement interval corresponding to JG: 

J (6-5) <3 (1-5)-* J (9- 8) G (4- 8) 

N (6-7) Z (1-7) H (9- 9) 0 (4- 9) 

S (9-20) P (4-20)—* S (2-14) P (5-14) 

Z (2- 8) C (5- 8) 

K (2- 5) D (5- 5) 

(2) Since J and G are sequent in the E J G N Z sequence, it can be said that all the letters 
of the foregoing pairs are also sequent. Hence Z C, S P, and K D are available as new data. 
These give E J G N Z C and T . K D . S P. 

(3) Now consider: 

T (€^-20) P (4-20) 

A (0- 1) E (4- 1) 

H (0- 8) G (4- 8) 

I (0- 9) 0 (4- 9) 

1 3 3 4 8 6 

Now in the T . K D . S P sequence the interval between T and P is T P. 

Hence the interval between A and E is 6 also. It follows therefore that the sequences A V H 0 F 
and E J G N Z C should be united, thus: 

1 2 3 4 5 6 

. . .AVHOF.EJGNZC. . . 

(4) Corroboration is found in the interval between H and G, which is also six. The letter I 
can be placed into position, from the relation I (0-9) 0 (4-9), thus: 

13 3 4 5 6 

. . .1. .AVHOF.EJGNZC. . . 

l. (1) From Figure 33: 

H (0- 8) Z (2- 8) 

E (0- 5) K (2- 5) 

N (0-14) S (2-14) 

U (0-21) F (2-21) 

(2) Since in the I. .AVHOF.EJGNZC sequence the letters H and Z are separated 
by 8 intervals one can write: 

12345673 

. . . H Z 

. . . E K 

.. . N S 

. . . U F 



t 
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(3) Hence one can make the sequence 



... I 
Then ... I 
and . . U I 



. . A V H 0 F . 

. . A V H 0 F . 

. . A V H 0 F . 

13341878 



1 3 8 4 5 8 

E JGNZC . 
E J G N Z C T 
EJGNZCT 

"*138 



8 

K . . . 

K D . S P . . . 

K D . S P . . . 

5 8 7 8 



m. (1) Subsequent derivations can be indicated very briefly as follows: 

E (0-5) C (0-3) 

D (5-5) R (5-3) 



1 3 8 4 8 8 7 8 9 10 11 13 13 14 15 18 17 18 19 30 31 

From U I . .AVHOF.EJGNZCT.KD. 
one can write ... E .... C .. . 

1 3 8 4 5 

and . . . D . 

i 

making the sequence 

1 3 8 4 8 8 7 8 0 10 11 13 IS 14 15 18 17 18 19 30 21 

U I . .AVHOF.EJGNZCT.KD. 
(2) Another derivation: 

U (3-20) T (0-20) 

X (3- 5) E (0- 5) 



32 23 34 35 38 

S P . . . 



. . . R . 

2 8 4 6 



22 23 34 25 26 

S P . R . 



1 2 3 4 8 6 7 8 9 10 11 12 IS 14 15 16 17 18 19 30 21 22 23 24 25 36 

From U I . .AVHOF.EJGNZCT.KD.SP.R. 
one can write 

U I T . . . 

and E X 



making the sequence 

1 3 8 4 5 8 7 8 9 10 11 12 18 14 15 16 17 18 19 20 21 22 23 24 25 26 

U I . . A V H O F . EJGNZCT . KDXSP . R. 
(3) Another derivation: 



From 

one can write 
and then 

There is only one place where B . ff can fit, viz, at the end: 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 18 17 18 19 20 21 22 23 24 26 26 

U I . .AVH0F. EJGNZCT. KDXSPBRW 



E (0-5) G (1-5) 

B (0-2) ff (1-2) 

• • . E J G . . ' . 
...E.G... 

. . . B . ff . . . 



n. Only four letters remain to be placed into the sequence, viz, L, M, Q, and 
positions are easily found by application of the primary component to the message, 
plete sequence is as follows: 

1 2 8 4 5 6 7 8 9 10 11 12 13 14 16 16 17 18 19 20 21 22 23 24 25 26 

UIMYAVHOFLEJGNZCTQKDXSPBRW 



Y. Their 
The com- 
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Having the primary component fully constructed, decipherment of the cryptogram can be 
completed with speed and precision. The text is as follows: 



WFUPCFOCJY 

BUTTHOUGHW 

GBZDPFBOUO 

ECANNOTASY 

GRFTZMQMAV 

ETREVIEWWI 

KZUGDYFTRW 

THTHEMINDS 

GJXNLWYOUX 

EYEOURPAST 

ITWEPQZOKZ 

WECANTOANE 

PRXCWLZICW 

XTENTFORES 

GKQHOLODVM 

EEOURFUTUR 

GOXSNZHASE 

EWECANWITH 

BBJIPQFJHD 

SCIENTIFIC 

QCBZEXQTXZ 

CONFIDENCE 

J CQRQFVMLH 
LOOKFORWAR 

SRQEWMLNAE 

DTOATIMEWH 

GSXEROZJSE 

ENEACHOFTH 

GVQWEJMKGH 

EBODIESCOM 



RCVOPNBLCI 

POSINGTHES 

LQZAAAMDCH 

OLARSYSTEM 

BZZCKQOIKF 

SHALLTURNA 

CFBSCVXCHQ 

NUNCHANGIN 

ZTZSDMXWCM 

GFACEINPER 

RKUHEQEDGX 

PETUITYTOT 

FKVHPJJKJY 

HESUNEACHW 

YQDPCJXLLL 

ILLTHENHAV 

GHXEROQPSE 

EREACHEDTH 

GKBWTLFDUZ 

EENDOFITSE 

OCDHWMZTUZ 

VOLUTIONSE 

KLBPCJOTXE 

TINTHEUNCH 

HSPOPNMDLM 

ANGINGSTAR 

GCKWDVBLSE 

EOFDEATHTH 

GSUGDPOTHX 

ENTHESUNIT 

rioxms 34. 



BKDZFMTGQJ 

SELFIILLGO 

LFUYDTZVHQ 

OUTBECOMIN 

ZGWNKXJTRN 

GACOLDANDL 

YTXCDPMVLW 

IFELESSMAS 

BGBWWOQRGN 

SANDTHESOL 

HHVLAQQV A V 
ARSYSTEMWI 

J QWOOTTNVQ 
LLCIRCLEUN 

BKXDSOZRSN 

SEENGHOSTL 

YUXOPPYOXZ 

IKEINSPACE 

HOZOWMXCGQ 

AWAITINGON 

JJUGJWQRVM 

LYTHERESUR 

UKWPEFXENF 

RECTIONOFA 

CCUGDWPEUH 

NOTHERCOSM 

YBWEWVMDYJ 

ICCATASTRO 

R Z X 
P H E 



o. The primary component appears to be a random-mixed sequence; no key word is to be 
found, at least none reappears on experimentation with various hypotheses as to enciphering 
equations. Nevertheless, the random construction of the primary component did not compli- 
cate or retard the solution. 
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р. Some students may prefer to work exclusively with the reconstruction skeleton, rather 
than with sliding strips. One method is as good as the other and personal preferences will dictate 
which will be used by the individual student. If the reconstruction skeleton is used, the original 
letters should be inserted in ink, so as to differentiate them from derived letters. 

36. General remarks. — a. It is to be stated that the sequence of steps described in the 
preceding paragraphs corresponds quite closely with that actually followed in solving the prob- 
lem. It is also to be pointed out that this method can be used as a control in the early stages 
of analysis because it will allow the cryptanalyst to check assumptions for values. For example, 
the very first value derived in applying the principles of indirect symmetry to the problem 
herein described was H„=A P in alphabet 1. As a matter of fact the writer had been inclined 
toward this value, from a study of the frequency and combinations which H„ showed; when the 
indirect-symmetry method actually substantiated his tentative hypothesis he immediately 
proceeded to substitute the value given. If he had assigned a different value to H„, or if he had 
assumed a letter other than H 0 for A D in that alphabet, the conclusion would immediately follow 
that either the assumed value for H„ was erroneous, or that one of the values which led to the 
derivation of H„=A P by indirect symmetry was wrong. Thus, these principles aid not only in 
the systematic and nearly automatic derivation of new values (with only occasional, or incidental 
references to the actual frequencies of letters), but they also assist very materially in serving as 
corroborative checks upon the validity of the assumptions already made. 

b. Furthermore, while the writer has set forth, in the reconstruction skeleton in Figure 33, 
a set of 30 values apparently obtained before he began to reconstruct the primary component, 
this was done for purposes of clarity and brevity in exposition of the principles herein described. 
As a matter of fact, what he did was to watch very carefully, when inserting values in the recon- 
struction skeleton to find the very first chance to employ the principles of indirect symmetry; 
and just as soon as a value could be derived, he substituted the value in the cryptographic text. 
This is good procedure for two reasons. Not only will it disclose impossible combinations but 
also it gives opportunity for making further assumptions for values by the addition of the derived 
values to those previously assumed. Thus, the processes of reconstructing the primary com- 
ponent and finding additional data for the reconstruction proceed simultaneously in an ever- 
widening circle. 

с. It is worth noting that the careful analysis of only 30 cipher equivalents in the recon- 
struction skeleton shown in Figure 33 results in the derivation of the entire table of secondary 
alphabets, 676 values in all. And while the elucidation of the method seems long and tedious, in 
its actual application the results are speedy, accurate, and gratifying in their corroborative effect 
upon the mental activity of the cryptanalyst. 

d. (1) The problem here used as an illustrative case is by no means one that most favorably 
presents the application and the value of the method, for it has been applied in other cases with 
much speedier success. For example, suppose that in a cryptogram of 6 alphabets the equivalents 
of only THE in all 6 alphabets are fairly certain. As in the previous case, it is supposed that the 
secondary alphabets are obtained by sliding a mixed alphabet against itself. Suppose the sec- 
ondary alphabets to be as follows: 
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D 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


i 










B 






Q 
























E 














2 










C 






L 
























X 














3 










I 






V 
























c 














4 










N 






P 
























B 














5 










X 






0 
























P 














6 










T 






Z 
























V 















Fiona* 35. 



(2) Consider the following chain of derivatives arranged diagrammatically: 



H (0- 8) 
T (0-20) 
E (0- 5) 



0 (5- 8) 
P (5-20) 
X (5- 5)- 



-»P (5-20) 
0 (5- 8) 
X (5- 5) 



»E (1-20) X (2-20) 

Q (1- 8) L (2- 8) 

B (1- 5) C (2- 5)— >B (4-20) 
N (4- 5) 
P (4- 8) 



V (6-20) 

Z (6- 8) 

T (6- 5)-*X (2-20) 
L (2- 8) 
C (2- 5) 



T (0-20) 

H (0- 8) 

E (0- 5)-»C (3-20) 
V (3- 8) 
I (3- 5) 



(3-20) 
(3- 5) 
(3- 8)- 



( 1 - 20 ) 
(1- 8) 



B (1- 5) 



Fionas 36. 



(3) These pairs manifestly all belong to the same displacement interval, and therefore 
unions can be made immediately. The complete list is as follows: 

EX, Q L, N I, L H, H 0, B C, 0 Z, C E, TP, P V, X T, V Q, IB 



(4) Joining pairs by their co mm on letters, the following sequence is obtained: 
. . . NIBCEXTPVQLHOZ . . . 



e. With this as a nucleus the cryptogram can be solved speedily and accurately. When 
it is realized that the cryptanalyst can assume THE’s rather readily in some cases, the value of 
this principle becomes apparent. When it is further realized that if a cryptogram has sufficient 
text to enable the THE’s to be found easily, it is usually also not at all difficult to make correct 
assumptions of values for two or three other high-frequency letters, it is clear that the principles 
of indirect symmetry of position may often be used with gratifyingly quick success to reconstruct 
the complete primary component. 

j. When the probable-word method is combined with the principles of indirect symmetry 
the solution of a difficult case is often accomplished with astonishing ease and rapidity. 

15201&—38 6 
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REPEATING-KEY SYSTEMS WITH MIXED CIPHER ALPHABETS, III 

Paragraph 



Solution of messages enciphered by known primary components 37 

Solution of repeating-key ciphers in which the identical mixed components proceed in opposite directions 38 

Solution of repeating-key ciphers in which the primary components are different mixed sequences 39 

Solution of subsequent messages after the primary components have been recovered 40 



37. Solution of subsequent messages enciphered by the same primary components. — a. In 
the discussion of the methods of solving repeating-key ciphers using secondary alphabets derived 
from the sliding of a mixed component against the normal component (Section Y), it was shown 
how subsequent messages enciphered by the same pair of primary components but with different 
keys could be solved by application of principles involving the completion of the plain-component 
sequence (paragraphs 23, 24). The present paragraph deals with the application of these same 
principles to the case where the primary components are identical mixed sequences. 

b. Suppose that the following primary component has been reconstructed from the analysis 
of a lengthy cryptogram: 

QUESTIONABLYCDFGHJKMPRVWXZ 

A new message exchanged between the same correspondents is intercepted and is suspected 
of having been enciphered by the same primary components but with a different key. The 
message is as follows: 

N F W W P NQMKI W_P I D S C A A E T Q V Z S E 

Y 0 J SC A A A F G R V N H D W D S C A E G N F P 

FOEMT HXLJW P N 0 M K I Q D B J I V N H L 

TFNCS BGCRP 

e. Factoring discloses that the period is 7 letters. The text is transcribed accordingly, and 
is as follows: 

N F W W P N 0 
MKIWPID 
SCAAETQ 
V Z S E Y 0 J 

S C A A A F G 

RVNHDO 
S C A E G N F 

P F 0 E M T H 

X L J W P N 0 

M K I Q D B J 

I V N H L T F 

N C S B G C R 

P 

FIQUBK 37. 

(78) 
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d. The letters belonging to the same alphabet are then employed as the initial letters of 
completion sequences, in the manner shown in paragraph 23e, using the already reconstructed 
primary component. The completion diagrams for the first five letters of the first three alphabets 
are as follows: 



Alphabet 1 

N M S V S 
APTIfT 
B R I X I 
L V 0 Z 0 

Y W N Q N 
C X A U A 
D Z B E B 
F Q L S L 
G U Y T Y 

*H E C I C 
J S D 0 D 
K T F N F 
M I G A G 
P 0 H B H 
R N J L J 

V A K Y K 
WBHCM 
X L P D P 
Z Y R F R 
Q C V G V 
U D W H W 
E F X J X 
S G Z K Z 
THQUQ 
I J U P U 
0 K E R E 



Alphabet 2 

F K C Z C 
GHDQD 
H P F U F 
J R G E G 
K V H S H 
M W J T J 
PXKIK 
RZHOM 

V Q P N P 
W U R A R 
X E V B V 
Z S W L W 
QTXYX 
U I Z c z 
E 0 Q D Q 
S N U F U 
T A E G E 
I B S H S 
0 L T J T 
N Y I K I 

*A C 0 M 0 
B D N P N 
L F A R A 

Y G B V B 
C H L W L 
D J Y X Y 

Figure 38. 



Alphabet 3 

ff I A S A 
X 0 B T B 
Z N L I L 
Q A Y 0 Y 
U B C N C 
E L D A D 
S Y F B F 
T C G L G 
I D H Y H 
0 F J C J 
N G K D K 
A H M F M 
B J P G P 
L K R H R 
YIIVSV 
C P W K W 
D R X M X 
F V Z P Z 
G V Q R Q 
H X U V U 
J Z E W E 
KQSXX 
M U T Z T 
PEIQI 
R S 0 U 0 
*V T N E N 



e. Examining the successive generatives to select the ones showing the best assortment of 
high-frequency letters, those marked in Figure 38 by asterisks are chosen. These are then assem- 
bled in columnar fashion and yield the following plain text: 



1 2 3 4 6 6 7 

H A V 
E C T 
CON 
I M E 
CON 



FlGOBE 30. 
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j. The corresponding key-letters are sought, using enciphering equations 0*/ c =0t/j>; ®p/b= 
0 e/e , and are foimd to be JOU, which suggests the keyword JOURNEY. Testing the key-letters 
RNEY for alphabets 4, 5, 6, and 7, the following results are obtained: 

1 2 3 4 6 6 7 

JOURNEY 
NFWffPNO 
H A V E D I R 

S C A A E T Q 

E C T E D S E 

Fiqom 40. 

The message may now be completed with ease. It is as follows: 



sL 


0 


U R N E Y 


J 


0 


U R N E 


_Y 


H 


A 


V 


E D 


I 


R 


S 


A 


I 


N C 


E 


I 


N 


F 


W 


W P 


N 


0 


P 


F 


0 


E M 


T 


H 


E 


C 


T 


E D 


S 


E 


N 


T 


H 


E D 


I 


R 


M 


K 


I 


W P 


I 


D 


X 


L 


J 


W P 


N 


0 


C 


0 


N 


D R 


E 


G 


E 


C 


T 


I 0 


N 


0 


S 


C 


A 


A E 


T 


Q 


M 


K 


I 


Q D 


B 


J 


I 


M 


E 


N T 


T 


0 


F 


H 


0 


R S 


E 


s 


V 


Z 


S 


E Y 


0 


J 


I 


V 


N 


H L 


T 


F 


c 


0 


N 


D U 


C 


T 


H 


0 


E 


F A 


L 


L 


s 


c 


A 


A A 


F 


G 


N 


C 


S 


B G 


C 


R 


T 


H 


0 


R 0 


R 


E 


S 












R 


V 


N 


H D 


ff 


D 


P 












C 


0 


N 


N A 


I 


S 














S 


C 


A 


E G 


N 


F 















FlOTO* 41. 



38. Solution of repeating-key ciphers in which the identical mixed components proceed in 
opposite directions. — The secondaiy alphabets in this case (paragraph 6, Case B (3) (a) (II) 
are reciprocal. The steps in solution are essentially the same as in the preceding case (para- 
graph 28) ; the principles of indirect symmetry of position can also be applied with the necessary 
modifications introduced by virtue of the reciprocity existing within the respective secondaiy 
alphabets (paragraph Sip). 

39. Solution of repeating-key ciphers in which the primary components are different mixed 
sequences. — This is Case B (3) (b) of paragraph 6. The steps in solution are essentially the same 
as in paragraphs 28 and 31, except that in applying the principles of indirect symmetry of posi- 
tion it is necessary to take cognizance of the fact that the primary components are different 
mixed sequences (paragraph 31g). 

40. Solution of subsequent messages after the primary components have been recovered. — 
o. In the case in which the primary components are identical mixed sequences proceeding in 
opposite directions, as well as in that in which the primary components are different mixed 
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sequences, the solution of subsequent messages 1 is a relatively easy matter. In both cases, how- 
ever, the student must remember that before the method illustrated in paragraph 37 can be 
applied it is necessary to convert the cipher letters into their plain-component equivalents 
before completing the plain-component sequence. From there on, the process of selecting and 
assembling the proper generatrices is the same as usual. 

6. Perhaps an example may be advisable. Suppose the enemy has been found to be using 
primary components based upon the keyword QUESTIONABLY, the plain component r unning 
from left to right, the cipher component in the reverse direction. The following new message 
has arrived from the intercept station: 



M V X 0 X 


B Z I Y Z 


N L ff Z H 


0 X I E 0 


0 0 E P Z 


F X S R X 


E J B S H 


B 0 N A U 


R A P Z I 


N R A M V, 


X 0 X A I 


J Y X ff F 


K N D 0 ff 


J E R C U 


R A L V B* 


Z A Q U ff 


J W X Y I 


D G R K D 


Q B D R M 


Q E C Y V 



Q W 



1 3 3 4 10 



3 4 5 6 



M V X 0 X B 
Z I Y Z N L 
W Z H 0 X I 
E 0 0 0 E P 
Z F X S R X 
E J B S H B 

0 N A U R A 
P Z I N R A 
M V X 0 X A 

1 J Y X W F 
K N D 0 W J 
E R C U R A 
L V B Z A Q 
U ff J W X Y 
I D G R K D 
Q B D R M Q 
ECYVQW 



c. Factoring discloses that the period is 6 and the mes- 
sage is accordingly transcribed into 6 columns, Fig. 42. 
The letters of these columns are then converted into their 
plain component equivalents by juxtaposing the two pri- 
mary components at any point of coincidence, for ex- 
ample Q p =Z e . The converted letters are shown in Fig. 43. 
The letters of the individual columns are then used as the 
initial letters of completion sequences, using the 
QUESTIONABLY primary sequence. The final step is the 
selection and assembling of the selected generatrices. 
The results for the first ten letters of the first three columns 
are shown below: 



0 S U M U H 
Q P F Q K G 
E Q B M U P 
W M M M ff I 
Q Y U V T U 
ff A H V B H 
M K J X T J 

1 Q P K T J 
0 S U M U J 
P A F U E Y 
N K C M E A 
ff T D X T J 
G S H Q J Z 
X E A E U F 
P C L T N C 
Z H C T 0 Z 
ff D F S Z E 



Fig he* 43. 



Flora* 43. 



1 That is, messages intercepted after the primary components have been reconstructed and enciphered by 
keys different from those used in the messages upon which the reconstruction of the primary components was 
accomplished. 
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0 Q E 


Column 1 

W Q W M I 0 


P 


Column 2 

SPQMYAKQS 


A 


U_ 


F 


Column 3 

B M U H J P 


U 


F 


N U S 


X U X P 0 N R 


T R U 


P 


C 


B 


M 


U T 


B 


E 


G 


L P E J K R 


E 


G 


A E T 


Z E Z R N A 


V 


*1 V E 


R 


D 


L 


P 


E I 


L 


S 


H 


YRSKHV 


S 


H 


B S I 


Q S Q V A B 


ff 


0 W S 


V 


F 


Y 


R 


S 0 


Y 


T 


J 


CYTlIPff 


T 


J 


L T 0 


U T U W B L X 


N X T 


ff 


G 


C 


V 


T N 


C 


I 


K 


D W I P R X 


I 


K 


YIN 


E I E X L Y 


z 


A Z I 


X 


H 


D 


W 


I A 


D 


0 


M 


F X 0 R V Z 


0 


M 


C 0 A 


S 0 S Z Y C 


Q 


B Q 0 


Z 


J 


F 


X 


0 B 


F 


N 


P 


G Z N V ff Q 


N 


P 


D N B 


TNTQCD 


u 


L U N 


Q 


K 


G 


z 


N L 


G 


A 


R 


H Q A W X U 


A 


R 


*F A L 


I A I U D F 


E 


YEA 


U 


M 


H 


Q 


A Y 


H 


B 


V 


J U B X Z E 


B 


V 


G B Y 


0 B 0 E F G 


S 


C S B 


E 


P 


J 


u 


B C 


J 


L 


W 


K E L Z Q S 


L 


ff 


H L C 


N L N S G H 


T 


D T L 


S 


R 


K 


E 


L D 


K 


Y 


X 


M S Y Q U T 


Y 


X 


J Y D 


A Y A T H J 


I 


F I Y 


T 


V 


M 


S 


Y F 


M 


C 


z 


P T C U E I 


C 


Z 


K C F 


B C B I J K 


0 


G 0 C 


I 


ff 


P 


T 


C G 


P 


D 


Q 


R I D E S 0 


D 


Q 


M D G 


LDLOKH 


N 


H N D 


0 


X 


R 


I 


D H 


R 


F 


u 


V 0 F S T N 


F 


U 


P F H 


YFYN11P 


A 


J A F 


N 


Z 


V 


0 


F J 


V 


G 


E 


ff N G T I A 


G 


E 


R G J 


C G C A P R B 


K B G 


A 


Q 


W 


N 


G K 


W 


H 


S 


X A H I 0 B 


H 


S 


V H K 


D H D B R V 


L 


M L H 


B 


u 


X 


A 


H M 


X 


J 


T 


Z B J 0 N L 


J 


T 


W J U 


F J F L V W 


Y 


P Y J 


L 


E 


Z 


B 


J P 


z 


K 


I 


Q L K N A Y 


K 


I 


X K P 


G K G Y W X 


C 


R C K 


Y 


S 


Q 


L 


K R 


Q 


M 


0 


U Y M A B C 


M 


0 


ZMRHMHCXZD 


V D M 


C 


T 


u 


Y 


M V 


u 


P 


N 


E C P B L D 


P 


N 


QPVJPJDZQF 


WFP 


D 


I 


E 


C 


P W 


E 


*R 


A 


S D R L Y F 


R 


A 


URWKRKFQUG 


X G R 


F 


0 


s 


D 


R X 


S 


V 


B 


T F V Y C G 


V 


B 


EVXMVMGUEH 


Z H V 


G 


N 


T 


F 


V Z 


T 


ff 


L 


I G ff C D H 


ff 


L 


S ff Z 


P W P H E S 


J 


Q J W 


H 


A 


I 


G 


W 0 


I 


X 


Y 


0 H X D F J 


X 


Y 


TXQRSRJST 


K 


U K X 


J 


B 


0 


H 


X U 


0 


z 


C 


N J Z F G K 


z 


C 


IZUVZVKTI 


M 


ESZ 


K 


L 


N 


J 


Z E 


N 


Q 


D 


AKQGHN 


Q 


D 



Flora* 44. 

Columnar assembling of selected generatrices gives what is shown in Fig. 45. 

12 8 4 6 6 

FIR. . . 

A V A . . . 

L E S . . . 

I R D . . . 

ADR. . . 

ILL. . . 

U P Y . . . 

D E F . . . 

FIR. . . 

E L A . . . 



Fiodee 46. 
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d. The key letters are sought, and found to be NUM, which suggests NUMBER. The entire 
message may now be read with ease. It is as follows: 



NUMBER 
F I R S T C 
M V X 0 X B 
A V A L R Y 
Z I Y Z N L 
L E S S T H 
W Z H 0 X I 
I R D S Q U 
E 0 0 0 E P 
A D R 0 N W 
Z F X S R X 
I L L 0 C C 
E J B S H B 
U P Y A N D 
0 N A U R A 
DEFEND 
P Z I N R A 
F I R S T D 
M V X 0 X A 



NUMBER 
E L A Y I N 
I J Y X W F 
G P 0 S I T 
K N D 0 ff J 
I 0 N A N D 
E R C U R A 
W I L L P R 
L V B Z A Q 

0 T E C T L 
U W J W X Y 
E F T F L A 
IDSRKD 
N K 0 F B R 
Q B D R M Q 

1 G A D E X 
E C Y V Q W 



Figure 46. 



e. If the primary components are different mixed sequences, the procedure is identical with 
that just indicated. The important point to note is that one must not fail to convert the letters 
into their plain-component equivalents before the completion-sequence method is applied. 
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Section X 

REPEATING-KEY SYSTEMS WITH MIXED CIPHER ALPHABETS, IV 

Paragraph 



General remarks 41 

Deriving the secondary alphabets, the primary components, and the key, given a cryptogram with its 

plain text 42 

Deriving the secondary alphabets, the primary components, and the keywords for messages, given two or 

more cryptograms in different keys and suspected to contain identical plain text 43 

The case of repeating-key systems 44 

The case of identical messages enciphered by keywords of different lengths 45 

Concluding remarks 46 



41. General remarks. — The preceding three sections have been devoted to an elucidation 
of the general principles and procedure in the solution of typical cases of repeating-key ciphers. 
This section will be devoted to a consideration of the variations in cryptanalytic procedure arising 
from special circumstances. It may be well to add that by the designation “special circum- 
stances” it is not meant to imply that the latter are necessarily unusual circumstances. The 
student should always he on the alert to seise upon any opportunities that may appear in which he may 
apply the methods to he described. In practical work such opportunities are by no means rare and 
are seldom overlooked by competent cryptanalysts. 

42. Deriving the secondary alphabets, the primary components, and the key, given a 
cryptogram with its plain text. — a. It may happen that a cryptogram and its equivalent plain 
text are at hand, as the result of capture, pilferage, compromise, etc. This, as a general rule, 
affords a very easy attack upon the whole system. 

h. Taking first the case where the plain component is the normal alphabet, the cipher com- 
ponent a mixed sequence, the first thing to do is to write out the cipher text with its letter-for- 
letter decipherment. Prom this, by a slight modification of the principles of “factoring”, one dis- 
covers the length of the key. It is obvious that when a word of three or four letters is enciphered 
by the same cipher text, the interval between the two occurrences is almost certainly a multiple 
of the length of the key. By noting a few recurrences of plain text and cipher letters, one can 
quickly determine the length of the key (assuming of course that the message is long enough to 
afford sufficient data). Having determined the length of the key, the message is rewritten accord- 
ing to its periods, with the plain text likewise in periods under the cipher letters. From this 
arrangement one can now reconstruct complete or partial secondary alphabets. If the secondary 
alphabets are complete, they will show direct symmetry of position; if they are but fragmentary 
in several alphabets, then the primary component can be reconstructed by the application of the 
principles of direct symmetry of position. 

c. If the plain component is a mixed sequence, and the cipher component the normal (direct or 
reversed sequence), the secondary alphabets will show no direct symmetry unless they are ar- 
ranged in the form of deciphering alphabets (that is, A e ... Z e above the zero line, with their 
equivalents below) . The student should be on the lookout for such cases. 

d. (1) If the plain and cipher primary components are identical mixed sequences proceeding 
in the same direction, the secondary alphabets will show indirect symmetry of position, and they 
can be used for the speedy reconstruction of the primary components (Paragraph 31a to o). 

( 84 ) 
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(2) If the plain and the cipher primary components are identical mixed sequences proceeding 
in opposite directions, the secondary alphabets will be completely reciprocal secondary alphabets 
and the primary component may be reconstructed by applying the principles outlined in para- 
graph 31p. 

(3) If the plain and the cipher primary components are different mixed sequences, the 
secondary alphabets will show indirect symmetry of position and the primary components may 
be reconstructed by applying the principles outlined in paragraph 31g. 

e. In all the foregoing cases, after the primary components have been reconstructed, the 
keys can be readily recovered. 

43. Deriving the secondary alphabets, the primary components, and the keywords for 
messages, given two or more cryptograms in different keys and suspected to contain identical 
plain text. — a. The simplest case of this kind is that involving two monoalphabetic substitution 
ciphers with mixed alphabets derived from the same pair of sliding components. An understand- 
ing of this case is necessary to that of the case involving repeating-key ciphers. 

b. (1) A message is transmitted from station A to station B. B then sends A some operating 
signals which indicate that B cannot decipher the message, and soon thereafter A sends a second 
message, identical in length with the first. This leads to the suspicion that the plain text of both 
messages is the same. The intercepted messages are superimposed. Thus: 

1. NXGRV MPUOF ZQVCP VWERX QDZVX WXZQE TBDSP VVXJK RFZWH ZUWLU IYVZQ FXOAR 

2. EMLHJ FGVUB PRJNG JKWHM RAPJM KMPRW ZTAXG JJMCD HBPKY PVKIV QOJPR BMUSH 

(2) Initiating a chain of cipher-text equivalents from message 1 to message 2, the following 
complete sequence is obtained: 

1 2 3 4 6 6 7 8 9 10 11 12 13 14 IS 18 17 18 1# 20 21 22 23 24 28 28 

NEWKDASXMFBTZPGLIQRHYOUVJ C 

(3) Experimentation along already-indicated lines soon discloses the fact that the foregoing 
component is an equivalent primary component of the original primary based upon the keyword 
QUESTIONABLY, decimated on the 21st interval. Let the student decipher the cryptogram. 

(4) The foregoing example is somewhat artificial in that the plain text was consciously 
selected with a view to making it contain every letter of the alphabet. The purpose in doing 
this was to permit the construction of a complete chain of equivalents from only two short 
messages, in order to give a simple illustration of the principles involved. If the plain-text message 
does not contain every letter of the alphabet, then only partial chains of equivalents can be con- 
structed. These may be united, if circumstances will permit, by recourse to the various prin- 
ciples elucidated in paragraph 31. 

(5) The student should carefully study the foregoing example in order to obtain a thorough 
comprehension of the reason why it was possible to reconstruct the primary component from the 
two cipher messages without having any plain text to begin with at all. Since the plain text of 
both messages is the same, the relative displacement of the primary components in the case of 
message 1 differs from the relative displacement of the same primary components in the case of 
message 2 by a fixed interval. Therefore, the distance between N and E (the first letters of the 
two messages), on the primary component, regardless of what plain-text letter these two 
cipher letters represent, is the same as the distance between E and W (the 18th letters), W and K 
(the 17th letters), and so on. Thus, this fixed interval permits of establishing a complete chain 
of letters separated by constant intervals and this chain becomes an equivalent primary com- 
ponent. 
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44. The case of repeating-key systems. — a. With the foregoing basic principles in mind 
the student is ready to note the procedure in the case of two repeating-key ciphers having identical 
plain texts. First, the case in which both messages have keywords of identical length but different 
compositions will be studied. 

b. (1) Given the following two cryptograms suspected to contain the same plain text: 



Y H Y E X 
PCQTU 
TROQS 



U B U K A 
N G K F A 
U H A F K 



Message 1 

P V L L T 
Z E F I Z 



A B U V V 
B D J E Z 



D Y S A B 
A L V I D 



Message 2 



C G S L Z 
M T A I Q 
V S N Z R 



Q U B M N 
Z ff M D Q 
B J N 0 Q 



C T Y B V 
N S D ff N 



H L Q F T 
L C B L Q 



F L R H L 
N E T 0 C 



(2) The first step is to try to determine the length of the period. The usual method of 
factoring cannot be employed because there are no long repetitions and not enough repetitions 
even of digraphs to give any convincing indications. However, a subterfuge will be employed, 
based upon the theory of factoring. 



c. (1) Let the two messages be superimposed. 



1 a 3 4 8 « 7 8 » 10 11 12 13 14 IS 16 17 18 19 20 

1. YHYEXUBUKAPVLLTABUVV 

2. CGSLZQUBMNCTYBVHLQFT 

21 22 23 24 25 26 27 28 29 30 31 32 33 34 36 36 37 38 30 40 

1. DYSABPCQTUNGKFAZEFIZ 

2. FLRHLMTAIQZWMDQNSDWN 

41 12 43 44 45 M 47 48 49 CO 81 82 83 54 55 Sfl 87 68 69 60 

1. BDJEZALVIDTROQSUHAFK 

2. LCBLQNET0CVSNZRBJN0Q 

4 44 

E E 

(2) Now let a search be made of cases of identical superimposition. For example, L and L 

6 18 30 

u u u 

are separated by 40 letters, Q, Q, and Q are separated by 12 letters. Let these intervals between 
identical superimpositions be factored, just as though they were ordinary repetitions. That 
factor which is the most frequent should correspond with the length of the period for the following 
reason. If the period is the same and the plain text is the same in both messages, then the con- 
dition of identity of superimposition can only be the result of identity of encipherments by 
identical cipher alphabets. This is only another way of saying that the same relative position in 
the keying cycle has been reached in both cases of identity. Therefore, the distance between 
identical superimpositions must be either equal to or else a multiple of the length of the period. 
Hence, factoring the intervals must yield the length of the period. The complete list of intervals 
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and factors applicable to cases of identical superimposed pairs is as follows (factors above 12 
are omitted): 



Repetition 


Interval 


Factors 


Repetition 


Interval 


Factors 


let. El. tn 2d ET. 


40 


2, 4, 6, 8, 10. 
2, 3, 4, 6, 12. 


1st, TV to 2d TV 


36 


2, 3, 4, 6, 9, 12. 
2, 4, 8. 


i«t uq to 2 d UQ 


12 


1st AH to 2d AH. 


8 


2d UQ to Sd uq 


12 


2, 3, 4. 6, 12. 


1st BL to 2d BL 


8 


2, 4, 8. 


lnt. UR to 2d UB 


48 


2, 3, 4, 6, 8, 12. 


2d BL to 3d BL ....... 


16 


2, 4, 8. 


1 nt KM tn 2d KM 


24 


2, 3, 4, 6, 8, 12. 


1st SR tn 2d SR 


32 


2, 4, 8. 


1st AN to 2d AN 


36 


2, 3, 4, 6, 9, 12. 


1st FD to 2d FD 


4 


2, 4. 


2d AN to 3d AN. 


12 


2, 3, 4, 6, 12. 


1st ZN to 2d ZN 


4 


2, 4. 


1st. VT to 2H VT 


8 


2, 4, 8. 


1st DC to 2d DC ...... ... 


8 


2, 4, 8. 


2d VT to 3d VT 


28 


2, 4, 7. 





(3) The factor 4 is the only one common to every one of these intervals and it may be taken 
as beyond question that the length of the period is 4. 

d. Let the messages now be superimposed according to their periods: 





12 3 4 


12 3 4 


12 3 4 


l 


2 3 4 


12 3 4 


12 3 4 


12 3 4 


1. 


Y H Y E 


X U B U 


K A P V 


L 


L T A 


B U V V 


D Y S A 


B P C Q 


2. 


C G S L 


Z Q U B 


M N C T 


Y 


B V H 


L Q F T 


F L R H 


L M T A 


1 . 


TUNG 


K F A Z 


E F I Z 


B 


D J E 


Z A L V 


I D T R 


0 Q S U 


2. 


I Q Z W 


M D Q N 


S D W N 


L 


C B L 


Q N E T 


0 C V S 


N Z R B 



1. H A F K 

2. J N 0 Q 

e. (1) Now distribute the superimposed letters into a reconstruction skeleton of “secondary 
alphabets.” 

Thus: 



0 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


1 




L 




F 


S 






J 


0 




M 


Y 






N 










I 








z 


C 


Q 


2 


N 






C 




D 




G 








B 








M 


Z 








Q 








L 




3 


Q 


U 


T 






0 






w 


B 




E 




Z 




C 






R 


V 




F 






S 




4 


H 








L 




w 








Q 












A 


S 






B 


T 








N 



(2) By the usual methods, construct the primary or an equivalent primary component. 
Taking lines 0 and 1, the following sequences are noted: 

BL, DF, ES, HJ, 10, KM, LY, ON, TI, XZ, YC, ZQ, 

which, when united by means of common letters and study of other sequences, yield the complete 
original primary component based upon the keyword QUESTIONABLY: 

QUESTIONABLYCDFGHJKMPRVWXZ 

(3) The fact that the pair of lines with which the process was commenced yield the original, 
primary sequence is purely accidental; it might have just as well yielded an equivalent primary 
sequence. 
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/. (1) Having the primary component, the solution of the messages is now a relatively simple 
matter. An application of the method elucidated in paragraph 37 is made, involving the comple- 
tion of the plain-component sequence for each alphabet and selecting those generatrices which 
contain the best assortments of high-frequency letters. Thus, using Message 1: 



First Alphabet 


Second Alphabet 


Thibd Alphabet 


Fourth Alphabet 


Y X 


_K 


_L 


_B 


H U A L U 


Y B 


P 


T 


_V 


E U V 


A V 


C 


Z 


M 


Y 


L 


J 


E B 


Y E 


G 


L 


R 


I 


w 


SEW 


B 


W 


D 


Q 


P 


C 


Y 


K 


S L 


C S 


D 


Y 


V 


0 


X 


T S X 


L 


X 


F 


U 


R 


D 


C 


M 


T Y 


D T 


F 


C 


W 


N 


z 


I T Z 


Y 


Z 


G 


E 


V 


F 


D 


P 


I C 


F I 


G 


D 


X 


A 


Q 


0 I Q 


C 


Q 


H 


S 


w 


G 


F 


R 


0 D 


G 0 


H 


F 


z 


B 


u 


N 0 U 


D 


u 


J 


T 


X 


H 


G 


V 


N F 


H N 


J 


G 


Q 


L 


E 


*A N E 


F 


E 


K 


I 


z 


J 


H 


W 


A G 


J A 


K 


H 


u 


Y 


S 


BAS 


G 


S 


M 


0 


Q 


K 


J 


X 


B H 


K B 


M 


J 


E 


C 


T 


L B T 


H 


T 


P 


N 


u 


M 


K 


z 


L J 


M L 


P 


K 


S 


D 


I 


Y L I 


J 


I 


R 


A 


E 


P 


M 


Q 


Y K 


P Y 


R 


M 


T 


F 


0 


C Y 0 


K 


0 


V 


B 


S 


R 


P 


U 


C M 


R C 


V 


P 


I 


G 


N 


D C N 


M 


N 


W 


L 


T 


V 


R 


E 


D P 


V D 


ff 


R 


0 


H 


A 


FDA 


P 


A 


X 


Y 


I 


w 


V 


S 


F R 


W F 


X 


V 


N 


J 


B 


G F B 


R 


B 


z 


C 


0 


X 


W 


T 


G V 


X G 


Z 


ff 


A 


K 


L 


H G L 


V 


L 


Q 


D 


N 


z 


X 


I 


H W 


Z H 


Q 


X 


B 


M 


Y 


J H Y 


W 


Y 


u 


F 


A 


Q 


z 


0 


J X 


Q J 


u 


z 


L 


P 


C 


K J C 


X 


C 


E 


G 


B 


u 


Q 


N 


K Z 


U K 


E 


Q 


Y 


R 


D 


HKD 


Z 


D 


S 


H 


L 


E 


u 


A 


M Q 


E M 


s 


U 


C 


V 


F 


P M F 


Q 


F 


T 


J 


Y 


S 


E 


B 


P U 


S P 


T 


E 


D 


ff 


G 


R P G 


U 


G 


I 


K 


C 


T 


S 


*L 


R E 


T R 


I 


S 


F 


X 


H 


VRH 


E 


H 


0 


M 


D 


I 


T 


Y 


V S 


I V 


0 


T 


G 


Z 


J 


W V J 


S 


J 


N 


P 


F 


0 


I 


C 


ff T 


0 W 


N 


I 


H 


Q 


K 


X ff K 


T 


K 


*A 


R 


G 


N 


0 


D 


X I 


N X 


A 


0 


J 


u 


M 


Z X M 


I 


M 


B 


V 


H 


A 


N 


F 


Z 0 


A Z 


B 


N 


K 


E 


P 


Q Z P 


0 


P 


L 


W 


J 


B 


A 


G 


Q N 


B Q 

] 


*L 

Figure 48. 


A 


M 


S 


R 


U Q R 


N 


R 



(2) The selected generatrices (those marked by asterisks in Fig. 48) are assembled in 
columnar manner: 

ALLA 
RRAN 
G E M E 
N T S F 
ORRE 



Fiona* «. 
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(3) The key letters are sought and give the keyword SOUP. The plain text for the second 
message is now known, and by reference to the cipher text and the primary components, the 
keyword for this message is found to be TIME. The complete texts are as follows: 



SOUP 


TIME 


ALLA 


ALLA 


YHYE 


C G S L 


R R A N 


R R A N 


X U B U 


Z Q U B 


G E M E 


G E M E 


K A P V 


M N C T 


N T S F 


N T S F 


L L T A 


Y B V H 


0 R R E 


0 R R E 


B U V V 


L Q F T 


LIEF 


LI E F 


D Y S A 


F L R H 


0 F Y 0 


0 F Y 0 


B P C Q 


L M T A 


U R 0 R 


U R 0 R 


TUNG 


I Q Z W 


G A N I 


G A N I 


K F A Z 


M D Q N 


Z A T I 


Z A T I 


E F I Z 


SOWN 


0 N H A 


0 N H A 


B D J E 


L C B L 


V E B E 


V E B E 


Z A L V 


Q N E T 


E N S U 


E N S U 


I D T R 


0 C V S 


S P E N 


S P E N 


0 Q S U 


N Z R B 


D E D X 


D E D X 


H A F K 


J N 0 Q 



Fzqttbx SO . 



45. The case of identical messages enciphered by keywords of different lengths. — a. In the 
foregoing case the keywords for the two messages, although different, were identical in length. 
When this is not true and the keywords are of different lengths, the procedure need be only 
slightly modified. 
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b. Given the following two cryptograms suspected of containing the same plain-text en- 
ciphered by the same primary components but with different keywords of different lengths, solve 
the messages. 

Message No. 1 



V 


M 


Y 


Z 


G 


E 


A 


U 


N 


T 


P K 


FAY 


J 


I Z 


M B 


U 


M Y K B 


V 


F 


I 


V V 


s 


E 


0 


A 


F 


S 


K 


X 


K 


R 


Y W 


C A C 


Z 


0 R 


D 0 


Z 


R D E F 


B 


L 


K 


F E 


s 


M 


K 


S 


F 


A 


F 


E 


K 


V 


Q U 


ROM 


Y 


Z V 


0 X 


V 


A B T A 


Y 


Y 


U 


0 A 


Y 


T 


D 


K 


F 


E 


N 


W 


N 


T 


D B 


Q K U 


L 


A J 


L Z 


I 


0 U M A 


B 


0 


A 


F S 


K 


X 


Q 


P 


U 


Y 


M 


J 


P 


W 


Q T 


D B T 


0 


S I 


Y S 


M 


I Y K U 


R 


0 


G 


M W 


C 


T 


M 


Z 


Z 


V 


M 


V 


A 


J 














































Message No. 2 
















Z 


G 


A 


M 


W 


I 


0 


M 


0 


A 


C 0 


D H A 


C 


L R 


L P 


M 


0 Q 0 J 


E 


M 


0 


Q U 


D 


H 


X 


B 


Y 


U 


Q 


M 


G 


A 


U V 


G L Q 


D 


B S 


P U 


0 


A B I R 


P 


W 


X 


Y M 


0 


G 


G 


F 


T 


M 


R 


H 


V 


F 


G ff 


K N I 


V A U 


P F 


A 


B R V I 


L 


A 


Q 


E M 


Z 


D 


J 


X 


Y 


M 


E 


D 


D 


Y 


B 0 


S V M 


P 


N L 


G X 


X 


D Y D 0 


P 


X 


B 


Y U 


Q 


M 


N 


K 


Y 


F 


L 


U 


Y 


Y 


G V 


PVR 


D 


N C 


Z E 


K J Q 0 R 


W 


J 


X 


R V 


G 


D 


K 


D 


S 


X 


C 


E 


E 


C 

























c. The messages are long enough to show a few short repetitions which permit factoring. 
The latter discloses that Message 1 has a period of 4 and Message 2, a period of 6 letters. The 
messages are superimposed, with numbers marking the position of each letter in the corresponding 
period, as shown below: 

123412341234123412341234 

No. 1. VMYZGEAUNTPKFAYJIZMBUMYK 
No. 2. ZGAMWI0M0AC0DHACLRLPM0Q0 

1234561234301284301 23466 

123412341234123412341234 

No. 1. BVFIVVSEOAFSKXKRYWCACZOR 
No. 2. JEMOQUDHXBYUQMGAUVGLQDBS 

1234561284661234 6 6123456 

123412341234123412341234 

No. 1. DOZRDEFBLKFESMKSFAFEKVQU 
No. 2. PUOABIRPWXYMOGGFTMRHVFGW 

123458123466123456123456 

123412341234123412341234 

No. 1. RCMYZVOXVABTAYYUOAYTDKFE 
No. 2. KNIVAUPFABRVILAQEMZDJXYM 

123456123466123456123456 

123412341234123412341234 

No. 1. NWNTDBQKULAJLZIOUMABOAFS 
No. 2. EDDYBOSVMPNLGXXDYDOPXBYU 

128456123456123456123456 
123412 3 41234123412341234 

No. 1. KXQPUYMJPWQTDBTOSIYSMIYK 
No. 2. QMNKYFLUYYGVPVRDNCZEKJ Q0 

123456123466123456123466 

1234123412341234 

No. 1. UROGMWCTMZZVMVAJ 
No. 2. RWJXRVGDKDSXCEEC 

1284561234661234 
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d. A reconstruction skeleton of “secondary alphabets” is now made by distributing the 

letters in respective lines corresponding to the 12 different superimposed pairs of numbers. For 

example, all pairs corresponding to the superimposition of position 1 of Message 1 with position 1 

of Message 2 are distributed in lines 0 and 1 of the skeleton. Thus, the very first superimposed 
1 

pair is JJ; the letter Z is inserted in line 1 under the letter V. The next {i pair is the 13th super- 

imposition, with j ^ ; the letter D is inserted in line 1 under the letter F, and so on. The skeleton 
is then as follows: 




Fromm si. 



e. There are more than sufficient data here to permit of the reconstruction of a complete 
equivalent primary component, for example, the following: 

1 2 3 4 S 6 7 8 9 10 11 13 13 14 IS 18 17 18 19 20 21 22 23 24 28 28 

ITKNPZHMWBQEULFCSJAXRGDVOY 

/. The subsequent steps in the actual decipherment of the text of either of the two messages 
are of considerable interest. Thus far the cryptanalyst has only the cipher component of the 
primary sliding components. The plain component may be identical with the cipher com- 
ponent and may progress in the same direction, or in the reverse direction; or, the two com- 
ponents may be different. If different, the plain component may be the normal sequence, 
direct or reversed. Tests must be made to ascertain which of these various possibilities is true. 

g. (1) It will first be assumed that the primary plain component is the normal direct 
sequence. Applying the procedure outlined in Par. 23 to the message with the shorter key 
(Message No. 1, to give the most data per secondary alphabet), an attempt is made to solve 
the message. It is unnecessary here to go further into detail in this procedure; suffice it to 
indicate that the attempt is unsuccessful and it follows that the plain component is not the 
normal direct sequence. A normal reversed sequence is then assumed for the plain component 
and the proper procedure applied. Again the attempt is found useless. Next, it is assumed 
that the plain component is identical with the cipher component, and the procedure outlined in 
Par. 37 is tried. This also is unsuccessful. Another attempt, assuming the plain component 
runs in the reverse direction, is likewise unsuccessful. There remains one last hypothesis, viz, 
that the two primary components are different mixed sequences. 



j 
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(2) Here is Message No. 1 transcribed in periods of four letters. Uniliteral frequency 
distributions for the four secondary alphabets are shown below in Fig. 52, labeled la, 2a, 3a, 
and 4a. These distributions are based upon the normal sequence A to Z. But since the recon- 
structed cipher component is at hand these distributions can be rearranged according to the 
sequence of the cipher component, as shown in distributions labeled 16, 26, 36, and 46 in Fig. 52. 
The latter distributions may he combined by shifting distributions 2b, 8b, and Jib to proper super- 
impositions with respect to lb so as to yield a single monoalphabetic distribution for the entire message. 
In other words, the polyalphabetic message can be converted into monoalphabetic terms, thus very 
considerably simplifying the solution. 



Message No. 1 

























g 




=5 




5 




= 








g 5 








V 


M 


Y 


Z 


V 


A 


B 


T 


la. 


A 


B 


C D E 


FGH 


I J K 


L 


M 


N 


0 


P Q R 


s 


T U V ff X 


Y 


z 


G 


E 


A 


u 


A 


Y 


Y 


U 




































N 


T 


P 


K 


0 


A 


Y 


T 
















5 












g| 






$ 


















2a. 


A B 


C D E 


F G H 


I J K 


L 


M 


N 


0 


P Q R S 


T U V W X Y 


z 


F 


A 


Y 


J 


D 


K 


F 


E 




































I 


Z 


M 


B 


N 


W 


N 


T 
























































a. 


g 






5 




% 




§ 








g 




U 


M 


Y 


K 


D 


B 


Q 


K 


3a. 


A 


B 


C D E 


FGH 


I J K 


L 


M 


N 


0 


P Q R S 


T U V ff X 


Y 


z 


B 


V 


F 


I 


U 


L 


A 


J 




































V 


V 


S 


E 


L 


Z 


I 


0 


4a. 


A 


I 


C D E 


FGH 


I J K 


L 


M 


N 


§ 


P Q R 1 


tHwx 


Y 


z 


0 


A 


F 


S 


U 


M 


A 


B 




































K 


X 


K 


R 


0 


A 


F 


S 




































Y 


w 


C 


A 


K 


X 


Q 


P 




































C 


z 


0 


R 


U 


Y 


M 


J 




















































16. 


. 




$ ^ ^ 


§ 


















^ ^ i§ 








D 


0 


Z 


R 


P 


ff 


Q 


T 


I 


TKNPZHMWBQ 


E 


U 


L 


F 


C 


S J 


A 


X R G D 


V 


0 


Y 


D 


E 


F 


B 


D 


B 


T 


0 




































L 


K 


F 


E 


S 


I 


Y 


S 


26. 


I 


T 


knpzhmIIq 


i 


U 


L 


F 


C 


S J 


g ^ 

A X R G D 


V 


0 


Y 


S 


M 


K 


S 


M 


I 


Y 


K 




































F 


A 


F 


E 


U 


R 


0 


G 


36. 


-- 








5 








j 













a. 


g 


















I 


T K N P 


ZHS 


W B Q 


E 


u 


L 


F 


c 


S J 


A X R G D 


V 


0 


Y 


K 


V 


Q 


U 


M 


W 


C 


T 


































R 


C 


M 


Y 


M 


z 


Z 


V 


46. 




g 


-5 
















a- ^ 












Z 


V 


0 


X 


M 


V 


A 


J 


I 


T 


KNP 


Z H M W B Q 


1 


u 


L 


F 


c 


S J 


A 


X R G D 


V 


0 


Y 



Flora* 82 . 
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(3) Note in Fig. 53 how the four distributions are shifted for superimposition and how the 
combined distribution presents the characteristics of a typical monoaiphabetic distribution. 

16 . 

26. 

36. 

46. 



16.-46. 
combined 

(4) The letters belonging to alphabets 2, 3, and 4 of Fig. 52 may now be transcribed in terms 
of alphabet 1. That is, the two E’s of alphabet 2 become I’s; the L of alphabet 2 becomes a K; 
the C becomes a P, and so on. likewise, the two K’s of alphabet 3 become I’s, the N becomes 
a T, and so on. The entire message is then a monoalphabet and can readily be solved. It is as 
follows: * 



V 


D 


V 


T 


G 


I 


S 


W 


N 


S 


K 


0 


F 


M 


V 


L 


I 


R 


Z 


Z 


u 


D 


V 


0 


B 


U 


U 


D 


V 


U 


E 


N 


E 


M 


Y 


H 


A 


s 


C 


A 


P 


T 


U 


R 


E 


D 


H 


I 


L 


L 


0 


N 


E 


T 


W 


0 


0 


N 


E 


0 


F 


M 


0 


M 


U 


U 


K 


w 


I 


S 


Y 


V 


L 


F 


C 


R 


D 


S 


D 


L 


N 


S 


D 


I 


U 


Z 


L 


J 


U 


M 


U 


R 


T 


R 


0 


0 


P 


s 


H 


A 


V 


E 


P 


U 


G 


I 


N 


A 


N 


D 


C 


A 


N 


H 


0 


L 


D 


F 


0 


R 


S 


D 


I 


U 


F 


M 


U 


M 


K 


U 


W 


W 


R 


P 


Z 


G 


Z 


G 


D 


C 


V 


M 


M 


V 


A 


F 


V 


W 


0 


M 


A 


N 


H 


0 


U 


R 


0 


R 


P 


0 


S 


S 


I 


B 


L 


Y 


L 


0 


N 


G 


E 


R 


R 


E 


Q 


U 


E 


S 


T 


R 


V 


V 


D 


J 


U 


M 


N 


V 


T 


V 


D 


0 


W 


0 


U 


K 


S 


L 


L 


R 


0 


R 


U 


D 


S 


Z 


0 


M 


U 


U 


E 


I 


N 


F 


0 


R 


C 


E 


M 


E 


N 


T 


S 


T 


0 


P 


A 


D 


D 


I 


T 


I 


0 


N 


A 


L 


T 


R 


0 


0 


K 


W 


ff 


I 


U 


F 


Z 


L 


P 


V 


w 


V 


D 


0 


Y 


R 


S 


C 


V 


U 


M 


C 


V 


0 


U 


B 


D 


J 


M 


V 


P 


S 


S 


H 


0 


U 


L 


D 


B 


E 


S 


E 


N 


T 


V 


I 


A 


G 


E 


0 


R 


G 


E 


T 


0 


W 


N 


F 


R 


E 


L 


V 


M 


R 


N 


X 


M 


U 


S 


L 










































D 


E 


R 


I 


C 


K 


R 


0 


A 


D 










































(5) 


Having 


the 


plain 


text, 


the 


derivation 


of the 


cipher component 


. (an equivalent) is an 



easy matter. It is merely necessary to base the reconstruction upon any of the secondary alpha- 
bets, since the plain text — cipher relationship is now known directly, and the primary cipher 
component is at hand. The primary plain component is found to be as follows: 

1 2 3 4 t 6 7 8 9 10 11 12 13 14 IS IS 17 18 19 20 21 22 23 24 25 26 

HMPCBL.RSW. . ODUGAFQKIYNETV 

(6) The keywords for both messages can now be found, if desirable, by finding the equivalent 
of A p in each of the secondary alphabets of the original polyalphabetic messages. The keyword 
for No. 1 is STAR; that for No. 2 is OCEANS. 

152018—38 7 



itknpzhmwbqeulfcsjaxrgdvSy 

EULFCSJAXRGDVOYITKNPZHMWBQ 

KNPZHMWB^EULFCSJ^XRGDVOYIT 

pzhoIqISlfcs j axrgd? §y!tkn 



I T K N P Z H 1 I I Q E U L F B I J A X R § D V 0 $ 

Figure 53. 
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(7) The student may, if he wishes, try to find out whether the primary components recon- 
structed above are the original components or are equivalent components, by examining all the 
possible decimations of the two components for evidences of derivation from keywords. 

h. As already stated in Par. 26Z, there are certain statistical and mathematical tests that 
can be employed in the process of “matching” distributions to ascertain proper superimpositions 
for monoalphabeticity. In the case just considered there were sufficient data in the distributions 
to permit the process to be applied successfully by eye, without necessitating statistical tests. 

i. This case is an excellent illustration of the application of the process of converting a 
polyalphabetic cipher into monoalphabetic terms. Because it is a very valuable and important 
cryptanalytic “trick,” the student should study it most carefully in order to gain a good under- 
standing of the principle upon which it is based and its significance in cryptanalysis. The 
conversion in the case under discussion was possible because the sequence of letters forming the 
cipher component had been reconstructed and was known, and therefore the uniliteral dis- 
tributions for the respective secondary cipher alphabets could theoretically be shifted to correct 
superimpositions for monoalphabeticity. It also happened that there were sufficient data in 
the distributions to give proper indications for their relative displacements. Therefore, the 
theoretical possibility in this case became an actuality. Without these two necessary conditions 
the superimposition and conversion cannot be accomplished. The student should always be 
on the lookout for situations in which this is possible. 

46. Concluding remarks. — a. The observant student will have noted that a large part of 
this text is devoted to the elucidation and application of a very few basic principles. These 
principles are, however, extremely important and their proper usage in the hands of a skilled 
cryptanalyst makes them practically indispensable tools of his ari. The student should therefore 
drill himself in the application of these tools by having someone make up problem after problem 
for him to practice upon, until he acquires facility in their use and feels competent to apply 
them in practice whenever the least opportunity presents itself. This will save him much time 
and effort in the solution of bona fide messages. 

b. Continuing the analytical key introduced in Military Cryptanalysis Part I, the outline 
for the studies covered by Part II follows herewith. 
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Analytical Key for Military Cryptanalysis, Part II * 

(Numbers in parentheses refer to Paragraph Numbers in this text) 
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APPENDIX 1 

The 12 Types of Cipher Squares 
(See Paragraph 7) 

Table I-B. 1 

Components: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) F B P Y R C 5 Z I G S E H T D J U 11 K V A L W N 0 X 
Enciphering equations: O k/2 — ©j/, ; G p/ i = 0 B/J (0j/i is A). 



PLAIN TEXT 





A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


A 


A 


L 


w 


N 


0 


X 


F 


B 


P 


Y 


R 


C 


Q 


Z 


I 


G 


s 


E 


H 


T 


D 


J 


u 


M 


K 


V 


B 


B 


P 


Y 


R 


C 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


U 


M 


K 


V 


A 


L 


W 


N 


0 


X 


F 


C 


C 


Q 


Z 


I 


G 


s 


E 


H 


T 


D 


J 


U 


M 


K 


V 


A 


L 


W 


N 


0 


X 


F 


B 


P 


Y 


R 


D 


D 


J 


U 


M 


K 


V 


A 


L 


W 


N 


0 


X 


F 


B 


p 


Y 


R 


C 


Q 


Z 


I 


G 


S 


E 


H 


T 


E 


E 


H 


T 


D 


J 


u 


M 


K 


V 


A 


L 


w 


N 


0 


X 


F 


B 


P 


Y 


R 


C 


Q 


Z 


I 


G 


S 


F 


F 


B 


P 


Y 


R 


c 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


U 


M 


K 


V 


A 


L 


W 


N 


0 


X 


G 


G 


S 


E 


H 


T 


D 


J 


U 


M 


K 


V 


A 


L 


W 


N 


0 


X 


F 


B 


P 


Y 


R 


C 


Q 


Z 


I 


H 


H 


T 


D 


J 


U 


M 


K 


V 


A 


L 


w 


N 


0 


X 


F 


B 


P 


Y 


R 


C 


Q 


Z 


I 


G 


S 


E 


I 


I 


G 


S 


E 


H 


T 


D 


J 


U 


M 


K 


V 


A 


L 


W 


N 


0 


X 


F 


B 


p 


Y 


R 


C 


Q 


Z 


J 


J 


U 


M 


K 


V 


A 


L 


W 


N 


0 


X 


F 


B 


P 


Y 


R 


c 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


K 


K 


V 


A 


L 


W 


N 


0 


X 


F 


B 


p 


Y 


R 


C 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


U 


M 


L 


L 


W 


N 


0 


X 


F 


B 


P 


Y 


R 


c 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


U 


M 


K 


V 


A 


X M 


M 


K 


V 


A 


L 


W 


N 


0 


X 


F 


B 


P 


Y 


R 


C 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


U 


« N 


N 


0 


X 


F 


B 


P 


Y 


R 


c 


Q 


z 


I 


G 


S 


E 


H 


T 


D 


J 


U 


M 


K 


V 


A 


L 


W 


0 


0 


X 


F 


B 


P 


Y 


R 


C 


Q 


z 


I 


G 


S 


E 


H 


T 


D 


J 


U 


M 


K 


V 


A 


L 


W 


N 


P 


P 


Y 


R 


C 


Q 


Z 


I 


G 


s 


E 


H 


T 


D 


J 


U 


M 


K 


V 


A 


L 


W 


N 


0 


X 


F 


B 


Q 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


U 


M 


K 


V 


A 


L 


W 


N 


0 


X 


F 


B 


P 


Y 


R 


C 


R 


R 


C 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


U 


M 


K 


V 


A 


L 


W 


N 


0 


X 


F 


B 


P 


Y 


S 


S 


E 


H 


T 


D 


J 


U 


M 


K 


V 


A 


L 


W 


N 


0 


X 


F 


B 


P 


Y 


R 


c 


Q 


Z 


I 


G 


T 


T 


D 


J 


U 


M 


K 


V 


A 


L 


W 


N 


0 


X 


F 


B 


P 


Y 


R 


C 


Q 


Z 


I 


G 


S 


E 


H 


U 


U 


M 


K 


V 


A 


L 


W 


N 


0 


X 


F 


B 


P 


Y 


R 


c 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


V 


V 


A 


L 


W 


N 


0 


X 


F 


B 


P 


Y 


R 


c 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


U 


M 


K 


W 


W 


N 


0 


X 


F 


B 


P 


Y 


R 


c 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


U 


M 


K 


V 


A 


L 


X 


X 


F 


B 


p 


Y 


R 


c 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


U 


M 


K 


V 


A 


L 


W 


N 


0 


Y 


Y 


R 


C 


Q 


Z 


I 


G 


s 


E 


H 


T 


D 


J 


E3 


M 


K 


V 


A 


L 


W 


N 


0 


X 


F 


B 


P 


Z 


Z 


I 


G 


s 


E 


H 


T 


D 


J_ 


U 


M 


_K 


_V_ 


A 


L 


W 


N 


0 


X 


F 


B 


P 


Y 


R 


C 


Q 



1 This table is labeled “Table 1-B” because it is the same as Table 1-A on page 7, except that the horizontal 
lines of the latter have been shifted so as to begin the successive alphabets with the successive letters of the normal 
sequence. 
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Table III 

Components: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALWN0X 

Enciphering equations: ©p/i=©c /2 (© 1/2 is F). 



ABC 



A F 
B T|_F 
C 0^ X 
D N 
E 
F 

G A 
H V 
I K 




PLAIN TEXT 

FGHIJKLMNOPQRSTUVWXYZ 

J U|H KVALWNOX 

E j H | T | D.AAXX X A AAA A 
T _D JJ^ M K_ _V A W_ J 

h_ x A A A A X X A A A 
e h__t_ AjL-M. a ax a a 
iinmiiiA 
z_ A A A A JL A A A A X X 
Q_AJlSLJlA2L AAAAXX 

RCQZIGSEHTDJU 

XA A AAA AAAA A AA 

P Y R__C_ Q Z 1_A S E H T D 

A AX A A AAAA A AAA 
AAAXAAAAAAAAA 
XAAAXAAAAAAAA 
AXAAAXAAAAAAA 
A AX A A AX A A All A 
A A AX A A AX A A AXX 
A A A AX A A AX A A AX 
AAAAAXAAAXAA A 
XAAAAAXAAAX A A 
A A A AAA o x f b p y r 

AA XAAAAAXAAAX 
AAA X A AAA AX AAA 
AAA AA AAAAAXA B 

I|G|S|E|H|T|D J UM K V A L W N 0 X 
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Table IV 

Components: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALWN0X 
Enciphering equations: 0*/i=0i/a; 0 D /a=Gc/i (0^a is F). 



PLAIN TEXT 





A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


p 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


A 


U 


B 


F 


0 


L 


A 


J 


M 


I 


n 


m 


□ 




0 


B 


c 


G 


E 


□ 


N 


Q 


T 


ff 


z 


D 


H 


B 


V 


C 


G 


P 


M 


B 


K 


N 


J 


Q 


T 


□ 




Y 


Z 


D 


H 


F 


L 


0 


R 


U 


X 


A 


E 


I 


C 


W 


D 


H 


Q 


N 


C 


L 


0 


K 




U 


X 


T 


Z 


A 


E 


I 


G 


M 


P 


S 


V 


Y 


B 


F 


J 


D 


X 


E 


I 


R 


0 


D 


m 


P 


L 




V 


Y 


U 


A 


B 


F 


J 


H 


N 


Q 


T 


W 


Z 


C 


G 


K 


E 


Y 


F 


J 


S 


P 


E 


N 


Q 


M 


T 


W 


Z 


V 


B 


C 


G 


K 


I 


0 


R 


U 


X 


A 


D 


H 


L 


F 


Z 


m 


K 


T 


Q 


Q 


□ 


R 


N 


U 


X 


A 


ff 


C 


D 


H 


L 


J 


P 


S 


V 


Y 


B 


E 


I 


M 


G 


A 


H 


L 


U 


R 


E3 


u 


S 


0 


V 


Y 


B 


X 


D 


E 


I 


m 


K 


Q 


T 


ff 


Z 


C 


F 


J 


N 


H 


B 


I 


M 


V 


S 


E2 


Q 


m 


P 


W 


Z 


C 


Y 


E 


□ 


J 


N 


L 


R 


U 


X 


A 


D 


G 


K 


0 


I 


C 


J 


N 


W 


T 


i 


R 


u 


Q 


X 


A 


D 


Z 


F 


G 


K 


0 


M 


S 


V 


Y 


B 


E 


H 


L 


P 


J 


D 


K 


0 


X 


U 


j 


S 


V 


R 


Y 


B 


E 


□ 


G 


H 


L 


P 


N 


T 


W 


Z 


C 


F 


I 


M 


Q 


K 


E 


L 


P 


Y 


V 


K 


T 


□ 


S 


Z 


□ 


F 


B 


H 


I 


U 


Q 


0 


u 


X 


A 


D 


G 


J 


N 


R 


L 


F 


M 


Q 


Z 


ff 


L 


U 


X 


T 


A 


D 


G 


C 


I 


J 


N 


R 


P 


V 


Y 


B 


E 


H 


K 


o 


s 


M 


G 


N 


R 


A 


□ 


□ 


V 


Y 


□ 


B 


□ 


H 


D 


J 


□ 


0 


s 


Q 


w 


Z 


C 


F 


I 


L 


P 


T 


N 


H 


0 


S 


B 


Y 


N 


W 


Z 


V 


C 


F 


I 


E 


K 


L 


P 


T 


R 


X 


A 


D 


G 


J 


M 


Q 


U 


0 


I 


P 


T 


C 


Z 


0 


X 


A 


W 


D 


G 


J 


F 


L 


M 


Q 


U 


S 


Y 


B 


E 


H 


K 


N 


R 


V 


P 


J 


Q 


U 


D 


A 


P 


Y 


B 


X 


E 


H 


K 


G 


M 


N 


R 


v 


T 


Z 


C 


F 


I 


L 


.0 


S 


W 


Q 


K 


R 


V 


E 


B 


Q 


Z 


C 


Y 


F 


I 


L 


H 


N 


0 


S 


ff 


U 


A 


D 


G 


J 


M 


P 


T 


X 


R 


L 


S 


W 


F 


C 


R 


A 


D 


Z 


G 


J 


M 


I 


0 


P 


T 


X 


V 


B 


E 


H 


K 


N 


Q 


U 


Y 


S 


M 


T 


X 


G 


D 


S 


B 


E 


A 


H 


K 


N 


J 


P 


Q 


U 


Y 


W 


C 


F 


I 


L 


0 


R 


V 


Z 


T 


N 


U 


Y 


H 


E 


T 


C 


F 


B 


I 


L 


0 


K 


Q 


R 


V 


Z 


X 


D 


G 


J 


M 


P 


S 


W 


A 


U 


0 


V 


Z 


I 


F 


U 


D 


G 


C 


J 


M 


P 


L 


R 


S 


w 


A 


Y 


E 


H 


K 


N 


Q 


T 


X 


B 


V 


P 


W 


A 


J 


G 


V 


E 


H 


D 


K 


N 


Q 


M 


S 


T 


X 


B 


Z 


F 


I 


L 


0 


R 


U 


Y 


C 


W 


Q 


X 


B 


K 


H 


W 


F 


I 


E 


L 


0 


R 


N 


T 


U 


Y 


C 


A 


G 


J 


M 


P 


S 


V 


Z 


D 


X 


R 


Y 


C 


L 


I 


X 


G 


J 


F 


M 


P 


S 


0 


U 


V 


z 


D 


B 


H 


K 


N 


Q 


T 


W 


A 


E 


Y 


S 


Z 


D 


M 


J 


Y 


H 


K 


G 


N 


Q 


T 


P 


V 


W 


A 


E 


C 


I 


L 


0 


R 


U 


X 


B 


F 


Z 


T 


A 


E 


N 


K 


Z 


I 


L 


H 


0 


R 


U 


Q 


w 


X 


B 


F 


D 


J 


M 


P 


S 


V 


Y 


C 


G 
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Table V 

Components: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALWN0X 
Enciphering equations: 0 k/ 2 =B D/1 ; 0| fl — 0 c ,a (0,/, is A). 



PLAIN TEXT 





A 


B 


C 


D 


E 


F 


G 


H 


I 


j 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


A 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I 


Z 


Q 


C 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


8 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I 


Z 


Q 


C 


R 


Y 


P 


C 


C 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


s 


G 


I 


Z 


Q 


D 


D 


T 


H 


E 


S 


G 


I 


Z 


Q 


C 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


e 


E 


S 


G 


I 


Z 


Q 


c 


R 


Y 


P 


B 


F 


X 


0 


N 


w 


L 


A 


V 


K 


M 


u 


J 


D 


T 


H 


F 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I 


Z 


Q 


c 


R 


Y 


P 


B 


8 


G 


I 


Z 


Q 


C 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


ri 


H 


E 


S 


G 


I 


Z 


Q 


C 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


i 


I 


Z 


Q 


C 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


G 


j 


J 


D 


T 


H 


E 


S 


G 


I 


Z 


Q 


c 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


K 


K 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I 


Z 


Q 


C 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


L 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I 


Z 


Q 


c 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


M 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I 


z 


Q 


C 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


N 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I 


Z 


Q 


c 


R 


Y 


P 


B 


F 


X 


0 


0 


0 


N 


W 


L 


A 


V 


K 


M 


u 


J 


D 


T 


H 


E 


S 


G 


I. 


Z 


Q 


C 


R 


Y 


P 


B 


F 


X 


P 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I 


Z 


Q 


C 


R 


Y 


Q 


Q 


C 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


s 


G 


I 


Z 


R 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I 


Z 


Q 


C 


S 


S 


G 


I 


Z 


Q 


c 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


T 


T 


H 


E 


S 


G 


I 


Z 


Q 


c 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


U 


U 


J 


D 


T 


H 


E 


S 


G 


I 


Z 


Q 


c 


R 


Y 


p 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


V 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I 


Z 


Q 


c 


R 


Y 


p 


B 


F 


X 


0 


N 


W 


L 


A 


W 


w 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I 


Z 


ft 


c 


R 


Y 


p 


B 


F 


X 


0 


N 


X 


X 


0 


N 


w 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I 


Z 


Q 


c 


R 


Y 


P 


B 


F 


Y 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I. 


Z 


Q 


C 


R 


Z 


z_ 




C 


R 


Y 


P 


B 


F 


JL 


_0_ 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H. 


E 


s 


G_ 


I 
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Table VI 

Components: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALWN0X 
Enciphering equations: 0k/ 2 =O c /i; 0i/i = 0p/a (©i/j is A). 

PLAIN TEXT 

abcdefghijklmnopqrstuvwxy: 
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Table VIII 

Componets: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALWN0X 

Enciphering equations: 0 k /3=O c /i; ©i/2=0p/i (© 1/2 is F). 

PLAIN TEXT 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 



m 






AAAA 

AAAA 

_Z_A. B__C 

AAAA 
JLJLAA. 
AA c iD~ 
AA 
A AAA 
g AAA 

K L M 



AAAA 
AAAA 
_AAAA 

P Q R S T 



Z I H 1 1 I JIKILIM 



AA 

AA 

F G 



<f_A 
AAA 
AAA 
AAA 

R__S_ 

u AAA 
A 2 A 

B 



G H I 



I J K L M 



MNOPQRS 



0 P QIRIS TIU V W XI Y 



G 

LA 

N I 0 P 
R 



ABC 
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Table IX 2 

Components: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALWN0X 
Enciphering equations: G k /i = 0 p/2 ; 0|/i=0 e /2 (9 i/i is A). 



PLAIN TEXT 





A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


s 


T 


U 


V 


W 


X 


Y 


Z 


A 


A 


B 


C 


D 


E 


~F 


T 


H 


I 


T 


K 


L 


M 


N 


0 


P 


Q 


R 


s 


T 


U 


V 


W 


X 


Y 


Z 


B 


V 


F 


R 


T 


S 


X 


I 


E 


Z 


D 


M 


A 


U 


W 


N 


B 


C 


Y 


G 


H 


J 


K 


L 


0 


P 


Q 


C 


K 


X 


Y 


H 


G 


0 


Z 


S 


Q 


T 


U 


V 


J 


L 


W 


F 


R 


P 


I 


E 


D 


M 


A 


N 


B 


c 


D 


M 


0 


P 


E 


I 


N 


Q 


G 


c 


H 


J 


K 


D 


A 


L 


X 


Y 


B 


Z 


S 


T 


U 


V 


w 


F 


R 


E 


U 


N 


B 


S 


Z 


W 


C 


I 


R 


E 


D 


M 


T 


V 


A 


0 


P 


F 


Q 


G 


H 


J 


K 


L 


X 


Y 


F 


J 


W 


F 


G 


Q 


L 


R 


Z 


Y 


S 


T 


U 


H 


K 


V 


N 


B 


X 


c 


I 


E 


D 


M 


A 


0 


P 


G 


D 


L 


X 


I 


c 


A 


Y 


Q 


P 


G 


H 


J 


E 


M 


K 


W 


F 


o 


R 


z 


S 


T 


U 


V 


N 


B 


H 


T 


A 


0 


Z 


R 


V 


P 


C 


B 


I 


E 


D 


S 


U 


M 


L 


X 


N 


Y 


Q 


G 


H 


J 


K 


ff 


F 


I 


H 


V 


N 


Q 


Y 


K 


B 


R 


F 


Z 


S 


T 


G 


J 


U 


A 


0 


W 


P 


C 


I 


E 


D 


M 


L 


X 


J 


E 


K 


W 


c 


P 


M 


F 


Y 


X 


Q 


G 


H 


I 


D 


J 


V 


N 


L 


B 


R 


Z 


S 


T 


U 


A 


0 


K 


S 


M 


L 


R 


B 


U 


X 


P 


0 


c 


I 


E 


Z 


T 


D 


K 


W 


A 


F 


Y 


Q 


G 


H 


J 


V 


N 




G 


U 


A 


Y 


F 


J 


0 


B 


N 


R 


Z 


S 


Q 


H 


T 


M 


L 


V 


X 


P 


C 


I 


E 


D 


K 


W 


« M 


I 


J 


V 


P 


X 


D 


N 


F 


W 


Y 


Q 


G 


c 


E 


H 


U 


A 


K 


0 


B 


R 


Z 


S 


T 


M 


L 


N 


Z 


D 


K 


B 


0 


T 


W 


X 


L 


P 


c 


I 


R 


S 


E 


J 


V 


M 


N 


F 


Y 


Q 


G 


H 


U 


A 


0 


Q 


T 


M 


F 


N 


H 


L 


0 


A 


B 


R 


Z 


Y 


G 


S 


D 


K 


U 


w 


X 


P 


c 


I 


E 


J 


V 


P 


C 


H 


U 


X 


W 


E 


A 


N 


V 


F 


Y 


Q 


P 


I 


G 


T 


M 


J 


L 


0 


B 


R 


Z 


S 


D 


K 


Q 


R 


E 


J 


0 


L 


S 


V 


W 


K 


X 


P 


c 


B 


Z 


I 


H 


U 


D 


A 


N 


F 


Y 


Q 


G 


T 


M 


R 


Y 


S 


D 


N 


A 


G 


K 


L 


M 


0 


B 


R 


F 


Q 


Z 


E 


J 


T 


V 


W 


X 


P 


C 


I 


H 


U 


S 


P 


G 


T 


W 


V 


I 


M 


A 


U 


N 


F 


Y 


X 


c 


Q 


S 


D 


H 


K 


L 


0 


B 


R 


Z 


E 


J 


T 


B 


I 


H 


L 


K 


Z 


U 


V 


J 


W 


X 


P 


0 


R 


c 


G 


T 


E 


M 


A 


N 


F 


Y 


Q 


S 


D 


U 


F 


Z 


E 


A 


M 


Q 


J 


K 


D 


L 


0 


B 


N 


Y 


R 


I 


H 


S 


U 


V 


W 


X 


P 


C 


G 


T 


V 


X 


Q 


S 


V 


U 


C 


D 


M 


T 


A 


N 


F 


W 


P 


Y 


Z 


E 


G 


J 


K 


L 


0 


B 


R 


I 


H 


W 


0 


C 


G 


K 


J 


R 


T 


U 


H 


V 


W 


X 


L 


B 


P 


Q 


S 


I 


D 


M 


A 


N 


F 


Y 


Z 


E 


X 


N 


R 


I 


M 


D 


Y 


H 


J 


E 


K 


L 


0 


A 


F 


B 


C 


G 


Z 


T 


U 


V 


W 


X 


P 


Q 


S 


Y 


W 


Y 


Z 


U 


T 


P 


E 


D 


S 


M 


A 


N 


V 


X 


F 


R 


I 


Q 


H 


J 


K 


L 


0 


B 


c 


G 


Z 


L 


P 


Q 


J 


H 


B 


S 


T 


_G_ 


_U_ 


V 


W 


K 


0 


X 


Y 


Z 


c 


E 


D 


M_ 


_A_ 


_N_ 


F 


R 


I 



8 An interesting fact about this case is that if the plain component is made identical with the cipher com- 
ponent (both being the sequence FBPY . . . ), and if the enciphering equations are the same as for Table 1-B, 
then the resultant cipher square is identical with Table IX, except that the key letters at the left are in the 
order of the reversed mixed component, FXON .... In other words, the secondary cipher alphabets produced 
by the interaction of two identical mixed components are the same as those given by the interaction of a 
mixed component and the normal component. 
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Table X 1 

Components: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALWN0X 

Enciphering equations: On/i^Oe/sI 61 / 1 = 60/3 ( 6 ,/j is A). 



PLAIN TEXT 





A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


p 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


A 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


p 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


B 


L 


P 


Q 


J 


H 


B 


S 


T 


G 


u 


V 


W 


K 


0 


X 


Y 


Z 


c 


E 


D 


M 


A 


N 


F 


R 


I 


C 


W 


Y 


Z 


U 


T 


P 


E 


D 


S 


M 


A 


N 


V 


X 


F 


R 


I 


Q 


H 


J 


K 


L 


0 


B 


C 


G 


D 


N 


R 


I 


M 


D 


Y 


H 


J 


E 


K 


L 


0 


A 


F 


B 


C 


G 


z 


T 


U 


V 


W 


X 


P 


Q 


S 


E 


0 


C 


G 


K 


J 


R 


T 


U 


H 


V 


W 


X 


L 


B 


P 


Q 


S 


1 


D 


M 


A 


N 


F 


Y 


Z 


E 


F 


X 


Q 


S 


V 


U 


C 


D 


M 


T 


A 


N 


F 


W 


P 


Y 


z 


E 


G 


J 


K 


L 


0 


B 


R 


I 


H 


G 


F 


z 


E 


A 


M 


Q 


J 


K 


D 


L 


0 


B 


N 


Y 


R 


I 


H 


S 


U 


V 


W 


X 


P 


C 


G 


T 


H 


B 


I 


H 


L 


K 


z 


U 


V 


J 


ff 


X 


P 


0 


R 


C 


G 


T 


E 


M 


A 


N 


F 


Y 


Q 


S 


D 


I 


P 


G 


T 


W 


V 


I 


M 


A 


U 


N 


F 


Y 


X 


C 


Q 


S 


D 


H 


K 


L 


0 


B 


R 


Z 


E 


J 


J 


Y 


S 


D 


N 


A 


G 


K 


L 


M 


0 


B 


R 


F 


Q 


Z 


E 


J 


T 


V 


W 


X 


P 


C 


I 


H 


U 


K 


R 


E 


J 


0 


L 


S 


V 


W 


K 


X 


P 


C 


B 


Z 


I 


H 


U 


D 


A 


N 


F 


Y 


Q 


G 


T 


M 


L 


C 


H 


U 


X 


W 


E 


A 


N 


V 


F 


Y 


Q 


P 


I 


G 


T 


M 


J 


L 


0 


B 


R 


Z 


s 


D 


K 




Q 


T 


M 


F 


N 


H 


L 


0 


A 


B 


R 


Z 


Y 


G 


S 


D 


K 


U 


W 


X 


P 


C 


I 


E 


J 


V 


K N 


Z 


D 


K 


B 


0 


T 


W 


X 


L 


P 


C 


I 


R 


S 


E 


J 


V 


M 


N 


F 


Y 


Q 


G 


H 


U 


A 


0 


I 


J 


V 


P 


X 


D 


N 


F 


W 


Y 


Q 


G 


C 


E 


H 


U 


A 


K 


0 


B 


R 


Z 


S 


T 


M 


L 


P 


G 


U 


A 


Y 


F 


J 


0 


B 


N 


R 


Z 


S 


Q 


H 


T 


M 


L 


V 


X 


P 


C 


I 


E 


D 


K 


ff 


Q 


S 


M 


L 


R 


B 


U 


X 


P 


0 


C 


I 


E 


z 


T 


D 


K 


W 


A 


F 


Y 


Q 


G 


H 


J 


V 


N 


R 


E 


K 


W 


C 


P 


M 


F 


Y 


X 


Q 


G 


H 


I 


D 


J 


V 


N 


L 


B 


R 


Z 


S 


T 


U 


A 


0 


S 


H 


V 


N 


Q 


Y 


K 


B 


R 


F 


Z 


S 


T 


G 


J 


U 


A 


0 


W 


P 


C 


I 


E 


D 


M 


L 


X 


T 


T 


A 


0 


Z 


R 


V 


P 


c 


B 


I 


E 


D 


s 


U 


M 


L 


X 


N 


Y 


Q 


G 


H 


J 


K 


W 


F 


U 


D 


L 


X 


I 


C 


A 


Y 


Q 


P 


G 


H 


J 


E 


M 


K 


W 


F 


0 


R 


z 


S 


T 


U 


V 


N 


B 


V 


J 


W 


F 


G 


Q 


L 


R 


Z 


Y 


S 


T 


U 


H 


K 


V 


N 


B 


X 


C 


I 


E 


D 


M 


A 


0 


P 


ff 


U 


N 


B 


S 


Z 


W 


C 


I 


R 


E 


D 


M 


T 


V 


A 


0 


P 


F 


Q 


G 


H 


J 


K 


L 


X 


Y 


X 


M 


0 


P 


E 


I 


N 


Q 


G 


C 


H 


J 


K 


D 


A 


L 


X 


Y 


B 


Z 


S 


T 


U 


V 


W 


F 


R 


Y 


K 


X 


Y 


H 


G 


0 


Z 


s 


Q 


T 


U 


V 


J 


L 


W 


F 


R 


P 


I 


E 


D 


M 


A 


N 


B 


C 


Z 


V 


_F_ 


JL 


T_ 


S 


X 


I 


E 


z 


D 


M 


_A_ 


U 


w_ 


2L 


B 


c 


Y 




_H_ 


J 


K_ 


L_ 


0 


_P_ 


Q 



* Footnote 2 to Table IX, page 104, also applies to this table, except that the key letters at the left will 
follow the order of the direct mixed component. 
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Table XI 

Components: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALffN0X 

Enciphering equations: 0i n =0 D/2 ; 0| /2 = 0c/i (0i/2 is F). 



PLAIN TEXT 





A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


A 


G 


Z 


V 


M 


P 


A 


R 


0 


S 


L 


I 


F 


J 


D 


C 


Y 


u 


W 


Q 


N 


K 


H 


E 


B 


X 


T 


B 


H 


A 


w 


N 


Q 


B 


S 


P 


T 


M 


J 


G 


K 


E 


D 


Z 


V 


X 


R 


0 


L 


I 


F 


C 


Y 


U 


C 


I 


B 


X 


0 


R 


C 


T 


Q 


U 


N 


K 


H 


L 


F 


E 


A 


w 


Y 


S 


P 


M 


J 


G 


D 


Z 


V 


D 


J 


C 


Y 


P 


S 


D 


U 


R 


V 


0 


L 


I 


M 


G 


F 


B 


X 


Z 


T 


Q 


N 


K 


H 


E 


A 


W 


E 


K 


D 


Z 


Q 


T 


E 


V 


S 


w 


P 


M 


J 


N 


H 


G 


C 


Y 


A 


U 


R 


0 


L 


I 


F 


B 


X 


F 


L 


E 


A 


R 


U 


F 


W 


T 


X 


Q 


N 


K 


0 


I 


H 


D 


Z 


B 


V 


S 


P 


M 


J 


G 


C 


Y 


G 


M 


F 


B 


S 


V 


G 


X 


U 


Y 


R 


0 


L 


P 


J 


I 


E 


A 


C 


W 


T 


Q 


N 


K 


H 


D 


Z 


H 


N 


G 


C 


T 


W 


H 


Y 


V 


Z 


s 


P 


M 


Q 


K 


J 


F 


B 


D 


X 


U 


R 


0 


L 


I 


E 


A 


I 


0 


H 


D 


U 


X 


I 


Z 


w 


A 


T 


Q 


N 


R 


L 


K 


G 


C 


E 


Y 


V 


S 


P 


M 


J 


F 


B 


J 


P 


I 


E 


V 


Y 


J 


A 


X 


B 


U 


R 


0 


S 


M 


L 


H 


D 


F 


Z 


W 


T 


Q 


N 


K 


G 


C 


K 


Q 


J 


F 


W 


Z 


K 


B 


Y 


C 


V 


S 


P 


T 


N 


M 


I 


E 


G 


A 


X 


U 


R 


0 


L 


H 


D 


L 


R 


K 


G 


X 


A 


L 


C 


Z 


D 


w 


T 


Q 


U 


0 


N 


J 


F 


H 


B 


Y 


V 


S 


P 


M 


I 


E 


M 


S 


L 


H 


Y 


B 


M 


D 


A 


E 


X 


U 


R 


V 


P 


0 


K 


G 


I 


C 


Z 


w 


T 


Q 


N 


J 


F 


N 


T 


M 


I 


Z 


C 


N 


E 


B 


F 


Y 


V 


s 


W 


Q 


P 


L 


H 


J 


D 


A 


X 


U 


R 


0 


K 


G 


0 


U 


N 


J 


A 


D 


0 


F 


C 


G 


Z 


W 


T 


X 


R 


Q 


M 


I 


K 


E 


B 


Y 


V 


S 


P 


L 


H 


P 


V 


0 


K 


B 


E 


P 


G 


D 


H 


A 


X 


U 


Y 


S 


R 


N 


J 


L 


F 


C 


Z 


W 


T 


Q 


M 


I 


Q 


W 


P 


L 


C 


F 


Q 


H 


E 


I 


B 


Y 


V 


Z 


T 


S 


0 


K 


M 


G 


D 


A 


X 


U 


R 


N 


J 


R 


X 


Q 


M 


D 


G 


R 


I 


F 


J 


C 


Z 


w 


A 


U 


T 


P 


L 


N 


H 


E 


B 


Y 


V 


S 


0 


K 


S 


Y 


R 


N 


E 


H 


S 


J 


G 


K 


D 


A 


X 


B 


V 


U 


Q 


M 


0 


I 


F 


C 


Z 


W 


T 


P 


L 


T 


Z 


S 


0 


F 


I 


T 


K 


H 


L 


E 


B 


Y 


C 


W 


V 


R 


N 


P 


J 


G 


D 


A 


X 


U 


Q 


M 


U 


A 


T 


P 


G 


J 


U 


L 


I 


M 


F 


C 


Z 


D 


X 


w 


S 


0 


Q 


K 


H 


E 


B 


Y 


V 


R 


N 


V 


B 


U 


Q 


H 


K 


V 


M 


J 


N 


G 


D 


A 


E 


Y 


X 


T 


P 


R 


L 


I 


F 


C 


Z 


w 


S 


0 


W 


C 


V 


R 


I 


L 


W 


N 


K 


0 


H 


E 


B 


F 


Z 


Y 


U 


Q 


S 


M 


J 


G 


D 


A 


X 


T 


P 


X 


D 


W 


S 


J 


M 


X 


0 


L 


P 


I 


F 


C 


G 


A 


Z 


V 


R 


T 


N 


K 


H 


E 


B 


Y 


U 


Q 


Y 


E 


X 


T 


K 


N 


Y 


P 


M 


Q 


J 


G 


D 


H 


B 


A 


W 


S 


U 


0 


L 


I 


F 


q 


Z 


V 


R 


Z 


F 


Y 


U 


L 


0 


Z 


Q 


N 


R 


K 


H 


E 


I 


C 


B 


X 


T 


V 


P 


M 


J 


G 


D 


A 


W 


S 




i 
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Table XII 

Components: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALWN0X 

Enciphering equations: 0 k /i=© c / 2 ; ©1/2= © D /i (©1/2 is F). 



PLAIN TEXT 





A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


s 


T 


u 


V 


ff 


X 


Y 


Z 


A 


F 


□ 


□ 


□ 


0 


L 


A 


□ 


□ 


O 


□ 


J 


D 


T 


0 


E 


s 


0 


I 


Z 


0 


0 


0 


Yj 


P 


B 


B 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I 


0 


0 


0 


R 


Y 


P 


C 


Qj 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I 


Z 


Q 


C 


R 


Y 


D 


Q 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I 


Z 


Q 


C 


R 


E 




Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I 


z 


Q 


C 


F 


0 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


0 


S 


0 


I 


z 


Q 


G 




C 


R 


Y 


P 


0 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


s 


G 


I 


Z 


H 


n 


Q 


C 


R 


Y 


p 


B 


F 


X 


0 


N 


W 


L 


A 


V 


0 


M 


U 


J 


D 


T 


H 


E 


S 


G 


I 


I 


1 


z 


Q 


C 


R 


Y 


P 


B 


F 


X 


0 


N 


c 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


0 


S 


G 


J 




□ 


z 


Q 


C 


R 


Y 


P 


B 


F 


X 


0 


0 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


K 




G 


I 


Z 


Q 


C 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


L 




S 


G 


I 


Z 


Q 


C 


R 


Y 


P 


0 


B 


□ 


0 


N 


W 


L 


A 


V 


K 


M 


u 


J 


D 


T 


H 


* M 


Q 


E 


S 


n 


I 


□ 


Q 


C 


R 


Y 


Pi 


B 


F 


X 


0 


N 


Q 


L 


A 


V 


K 


M 


U 


J 


D 


T 


W N 


Q 


H 


E 


n 


G 


I 


Z 


Q 


C 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


D 


0 


D 


T 


H 


n 


S 


G 


I 


z 


Q 


□ 


R 


□ 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


J 


P 


J 


D 


T 




E 


S 


G 


1 


Z 


0 


C 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


V 


K 


M 


U 


Q 


U 


J 


D 


n 


H 


E 


S 


0 


□ 


2 


Q 


C 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


A 


□ 


K 


M 


R 


M 


U 


J 


D 


T 


H 


E 


s 


G 


I 


Z 


Q 


C 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


□ 


V 


K 


S 


K 


M 


U 




D 


T 


H 


E 


S 


G 


I 


Z 


Q 


C 


R 


Y 


0 


0 


F 


Q 


gj 


N 


W 


L 


A 


V 


T 


V 


K 


M 




J 


D 


T 


H 


E 


S 


G 


1 


Z 


Q 


C 


R 


Y 


P 


B 






0 


N 


W 


L 


A 


U 


A 


V 


K 




U 


J 


D 


T 


H 


E 


S 


G 


I 


Z 


Q 


C 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


L 


V 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


S 


0 


n 


0 


n 


C 


R 


Y 


P 


B 


F 


X 


0 


N 


W 


w 


W 


L 


A 


V 


K 


M 


U 


J 


D 


T 


H 


E 


s 




I 


n 


Q 


C 


R 


Y 


P 


B 


F 


X 
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APPENDIX 2 1 

Elementary Statistical Theory Applicable to the Phenomena of Repetition 

in Cryptanalysis 

1. Introductory.— a. In Par. 9c it was stated that the phenomena of repetition in crypt- 
analytics may be removed from the realm of intuition and dealt with statistically. The dis- 
cussion of the inattor will here bo confined to relatively simple phases of the theory of probability, 
a definition of which implies philosophical questions of no practical interest to the student of 
cryptanalysis. For his purposes, the following definition of a priori probability will be sufficient: 

The probability that an event will occur is the ratio of the number of “fav- 
orable cases” to the number of total possible cases, all cases being equally 
likely to occur. By a “favorable case” is meant one which will produce the 
event in question. 

b. In what follows, reference will be made to random assortments of letters and especially to 
random text. By the latter will be meant merely that the text under consideration has been as- 
sumed to have been enciphered by some more or less complex cryptographic system so that for 
all practical purposes the sequence of letters constituting this text is a random assortment; that 
is, the sequence is just about what would have been obtained if the letters had been drawn at 
random out of a box containing a large number of the 26 letters of the alphabet, all in equal 
proportions, so that there are exactly the same numbers of A’s, B’s, C’s, . . . Z’s. It is assumed 
that oach time in making a drawing from such a box, the latter is thoroughly shaken so that the 
letters are thoroughly mixed and then a single letter is selected at random, recorded, and 
replaced in the same box. In what follows, the word “box” will refer to the box as described. 

c. A uniliteral frequency distribution of a large volume of random text will be “flat,” 
i. e., lacking crests, and troughs. 

d. For purposes of statistical analysis, the toxt of a monoalphabetic substitution cipher is 
equivalent to plain text. As a corollary, when a polyalphabetic substitution cipher has been 
reduced to the simple terms of a set of monoalphabets, i. e., when the letters constituting the 
cipher text have been allocated into their proper uniliteral distributions, the letters falling into 
the respective distributions are statistically equivalent to plain text. 

2. Data pertaining to single letters. — a. (1) A single letter will be drawn at random from 
the box. What is the probability that it will be an A? According to the foregoing definition of 
probability, since the total number of possible cases is 26 and the number of favorable cases is 

here only 1, the probability is 1 : 26=^=.0385. This is the probability of drawing an A from 

the box. The probability that the letter drawn will be a B, a C, a D, . . ., a Z is the same as for A. 
In other words, the probability of drawing any specified single letter is p=.0385. 

(2) The value p=.0385, as found above, may also be termed the probability constant for 
single letters in random text of a 26-letter alphabet. For any language this constant is merely 
the reciprocal of the total number of different characters which may be employed in writing the 
text in question. 

1 In the preparation of this appendix, the author has had the benefit of the very helpful suggestions of 
Capt. H. G. Miller, Signal Corps, Mr. F. B. Rowlett, Dr. S. Rollback, and Dr. A. Sinkov, Assistant Cryptanalysts, 
O. C. Sig. O. Certain parts of Dr. Kullback’s important paper “Statistical Methods in Cryptanalysis” form 
the basis of the discussion. 
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(3) Another way of interpreting the notation p=.0385 is to say that in a large volume of 
random text, for example in 100,000 letters, any letter that one may choose to specify may be 
expected to occur about 3,850 times; in 10,000 letters it may be expected to occur about 385 
times; in 1,000 letters, about 38.5 times, and so on. In every-day language it would be said 
that “in the long run” or “on the average” in 1,000 letters of random text there will be about 
38.5 occurrences of each of the 26 letters of the alphabet. 

(4) But unfortunately, in cryptanalysis it is not often the case that one has such a large 
number of letters available for study in any single cipher alphabet. More often the cryptanalyst 
has a relatively small number of letters and these must be distributed over several cipher 
alphabets. Hence it is necessary to be able to deal with smaller numbers of letters. Consider 
a specific piece of random text of only 100 letters. It has been seen that “in the long run” 
each letter may be expected to occur about 3.85 times in this amount of random text; that is, 
the 26 letters will have an average frequency of 3.85. But in reaching this average of 3.85 
occurrences in 100 letters, it is obvious that some letter or letters may not appear at all, some 
may appear once, some twice, and so on. How many will not appear at all; how many will 
appear 1 , 2, 3, . . . times? In other words, how will the different categories of letters (differ- 
ent in respect to frequency of occurrence) be distributed, or what will the distribution be like? 
Will it follow any kind of law or pattern? The cryptanalyst also wants to know the answer 
to questions such as these: What is the probability that a specified letter will not appear at 
all in a given piece of text? That it will appear exactly 1 , 2, 3, . . . times? That it will appear 
at least 1, 2, 3, . . . times? The same sort of questions may be asked with respect to digraphs, 
trigraphs, and so on. 

b. (1) It may be stated at once that questions of this nature are not easily answered, and 
a complete discussion falls quite outside the scope of this text. However, it will be sufficient 
for the present purposes if the student is provided with a more or less simple and practical means 
of finding the answers. With this in view certain curves have been prepared from data based 
upon Poisson’s exponential expansion, or the “law of small probabilities” and their use will 
now be explained. Students without a knowledge of the mathematical theory of probability 
and statistics will have to take the curves “on faith” Those interested in their derivation are 
referred to the following texts: 

Fisher, R. A., Statistical Methods jor Research Workers, London, 1937. 

Fry, T. C., Probability and Its Engineering Uses, New York, 1928. 

(2) By means of these probability curves, it is possible to find, in a relatively easy manner, 
the probability for 0, 1, 2, . . . 11 occurrences of an event in n cases, if the mean (expected, 
average, probable) number of occurrences in these n cases is known. For example, given a cryp- 
togram equivalent to 100 letters of random text, what is the probability that any specified single 
letter, whatever will not appear at all in the cryptogram? Since the probability of the occurrence 

of a specified single letter is 2g=.0385, and there ore 100 letters in the cryptogram, the average 

or expected or mean number of occurrences of an A, a B, a C, . . ., is .0385X100=3.85. Refer 
now to that probability curve which is marked “/ 0 ”, meaning “frequency zero”, or “zero occur- 
rences.” On the horizontal or x axis of that curve find the point corresponding to the value 
3.85 and follow the vertical coordinate determined by this value up to the point of intersection 
with the curve itself; then follow the horizontal coordinate determined by this intersection point 
over to the left and read the value on the vertical axis of the curve. It is approximately .021. 
This means that the probability that a specified single letter (an A, a B, a C, . . .) will not appear 
at all in the cryptogram, if it really were a perfectly random assortment of 100 letters, is .021. 
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That is, according to the theory of probability, in 1,000 cases of random-text messages of 100 
letters each, one may expect to find about 21 messages in which a specified single letter will not 
appear at all. Another way of saying the same thing is: If 1,000 sets of 100 letters of random 
text are examined, in about 21 out of the 1,000 such sets any letter that one may choose to 
name will be absent. This, of course, is merely a theoretical expectancy; it indicates only 
what probably will happen in the long run. 

(3) What is the probability that a specified single letter will appear exactly once in 100 
letters of random text? To answer this question, find on the curve marked f u the point of 
intersection of the vertical coordinate corresponding to the mean or average value 3.85 with 
the curve; follow the horizontal coordinate thus determined over to the vertical scale at the 
left; read the value on this scale. It is .082, which means that in 1,000 cases of random-text 
messages of 100 letters each, one may expect to find about 82 messages in which any letter 
one chooses to specify will occur exactly once, no more and no less. 

(4) In the same way, the probability that a specified single letter will appear exactly twice 
is found to be .158; exactly 3 times, .202; and so on, as shown in the table below: 



100 letters of random text 



Frequency 

(*) 


Probability that 
a specified single 
letter will occur 
exactly z times 


0 


0. 021 


1 


.082 


2 


. 158 


3 


. 202 


4 


. 195 


6 


. 150 


6 


. 096 


7 


. 053 


8 


. 026 


9 


.011 


10 


. 004 


11 


.001 



(5) To find the probability that a specified single letter will occur at least 1 , 2, 3, . . . times 
in a series of letters constituting random text, one reasons as follows: Since the concept "at least 
1” implies that the number specified is to be considered only as the minimum, with no limit 
indicated as to maximum, occurrences of 2, 3, 4, . . . are also "favorable” cases; the probabilities 
for exactly 1, 2, 3, 4, . . . occurrences should therefore be added and this will give the probability 
for “at least 1.” Thus, in the case of 100 letters, the sum of the probabilities for exactly 1 to 11 
occurrences, as set forth in the table directly above, is .978, and the latter value approximates 
the probability for at least 1 occurrence. 

(6) A more accurate result will be obtained by the following reasoning. The probability 
for zero occurrences is .021. Since it is certain that a specified letter will occur either zero times 
or 1, 2, 3, . . . times, to find the probability for at least one time it is merely necessary to sub- 
tract the probability for zero occurrences from unity. That is, 1— .021 =.979, which is .001 
greater than the result obtained by the other method. The reason it is greater is that the value 
.979 includes occurrences beyond 11, which were excluded from the previous calculation. Of 
course, the probabilities for these occurrences beyond 1 1 are very small, but taken all together they 
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add up to .001, the difference between the results obtained by the two methods. The proba- 
bility for at least 2 occurrences is the difference between unity and the sum of the probability 
for zero and exactly 1 occurrences; that is, 1 — (P 0 +Pi) = l — (.021+.082) = 1— .103=.897. The 
respective probabilities for various numbers of occurrences of a specified single letter (from 0 to 
11) are given in the following table: 



100 letters of random text 



Frequency 

(*) 


Probability that a 
specified single 
letter will occur 
exactly x 
times 


Probability that a 
specified single 
letter will occur 
at least i 

Httim 


0 


0.021 


1. 000 


1 


.082 


.979 


2 


. 158 


. 897 


3 


. 202 


. 739 


4 


. 195 


. 537 


5 


. 150 


.342 


6 


.096 


. 192 


7 


.053 


.096 


8 


.026 


. 043 


9 


.011 


.017 


10 


. 004 


. 006 


11 


.001 


.002 



(7) The foregoing calculations refer to random text composed of 100 letters. For other 
numbers of letters, it is merely necessary to find the mean (multiply the probability for drawing 

a specified single letter out of the box, which is or .0385, by the number of letters in the 

assortment) and refer to the various curves, as before. For example, for a random assortment 
of 200 letters, the mean is 200 X .0385, or 7.7, and this is the value of the point to be sought along 
the horizontal or x axes of the curves; the intersections of the respective vertical lines correspond- 
ing to this mean with the various curves for 0, 1, 2, 3, . . . occurrences give the probabilities for 
these occurrences, the reading being taken on the vertical or y axes of the curves. 

(8) The discussion thus far has dealt with the probabilities for 0, 1, 2, 3, . . . occurrences 
of specified single letters. It may be of more practical advantage to the student if he could be 
shown how to find the answer to these questions: Given a random assortment of 100 letters 
how many letters may be expected to occur exactly 0, 1, 2, 3, . . . times? How many may be 
expected to occur at least 1, 2, 3, . . . times? The curves may here again be used to answer 
these questions, by a very simple calculation: multiply the probability value as obtained above 
for a specified single letter by the number of different elements being considered. For example, 
the probability that a specified single letter will occur exactly twice in a perfectly random assort- 
ment of 100 letters is .158; since the number of different letters is 26, the absolute number of single 
letters that may be expected to occur exactly 2 times in this assortment is .158X26=4.108. 
That is, in 100 letters of randm text there should be about four letters which occur exactly 2 times. 
The following table gives the data for various numbers of occurrences. 
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100 letters of random text 



Frequency 

<*) 


Probability that a 
specified single 
letter will occur 
exactly z 
times 


Probability that a 
specified single 
letter will occur 
at least z 
times 


Probable number 
of letters appear- 
ing exactly z 
times 


Probable number 
of letters appear- 
ing at leasts 
times 




EH 




a 546 


26.000 






.979 


2. 132 


25. 454 






.897 


4 108 


2 a 322 




.202 


. 739 


5. 252 


19. 214 




. 195 


. 537 


5. 070 


ia 962 


5 


. 150 


. 342 


3. 900 


& 892 


6 


.096 


. 192 


2.496 


4.992 


7 


.053 


. 096 


1. 378 


2. 496 


8 


. 026 


. 043 


.676 


1. 118 


9 


.011 


.017 


.286 


.442 


10 


. 004 


. 006 


. 104 


. 156 


11 


.001 


.002 


. 026 


.052 



(9) Referring again to the curves, and specifically to the tabulated results set forth directly 
above, it will be seen that the probability that there will be exactly two occurrences of a specified 
single letter in 100 letters of random text (.158), is less than the probability that there will be 
exactly three occurrences (.202) ; in other words, the chances that a specified single letter will 
occur exactly three times are better, by about 25 percent, than that it will occur only two times. 
Furthermore, there will be about five letters which will occur exactly 3 times, and about five 
which will occur exactly 4 times, whereas there will be only about two letters which will occur 
exactly 1 time. Other facts of a similar import may be deduced from the foregoing table. 

c. The discussion thus far has dealt with random assortments of letters. What about other 
types of texts, for example, normal plain text? What is the probability that E will occur 0, 1, 
2, 3, . . . times in 50 letters of normal English? The relative frequency value or probability 
that a letter selected at random from a large volume of normal English text will be E is .12604. 
(In 100,000 letters E occurred 12,604 times.) For 50 letters this value must be multiplied by 50, 
giving 6.3 as the mean or point to be found along the x axes of the curves. The probabilities for 
0, 1, 2, 3, . . . occurrences are tabulated below: 



SO letters of normal English plain text 



Frequency 

<*) 


Probability that 
an B will be 
drawn exactly 
x times 


Probability that 
an E will be 
drawn at least 
x times 


0 


0. 002 


1. 000 


i 


.011 


.998 


2 


.036 


. 987 


3 


.076 


.951 


4 


. 120 


.875 


5 


. 151 


.755 


6 


. 159 


.604 


7 


. 143 


.445 


8 


. 113 


.302 


9 


.079 


. 223 


10 


.050 


. 173 


11 


.029 


.123 
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d. (1 ) It has been seen that the probability of occurrence of a specified single letter in random 

test employing a 26-letter alphabet is P = ^g~- 0385. If a considerable volume of such text is 

written on a large sheet of paper and a pencil is directed at random toward this text, the probabil- 
ity that the pencil point will hit the letter A, or any other letter which may be specified in advance, 
is .0385. Now suppose two pencils are directed simultaneously toward the sheet of paper. The 

probability that both pencil points will hit two A’s is ^X^=2^=.00148, since in this case 

one is dealing with the probability of the simultaneous occurrence of two events which are 

independent. The probability of hitting two B’s, two C’s, . . ., two Z’s is likewise Hence, 

if no particular letter is specified, and merely this question is asked: “What is the probability 
that both pencil points will hit the same letter?” the answer must be the sum of the separate 
probabilities for simultaneously hitting two A’s, two B’s, and so on, for the whole alphabet, 

which is 26 = -0385, This, then, is the probability that any two letters selected at random 

in random text of a 26-letter alphabet will be identical or will coincide. Since this value remains 
the same so long as the number of alphabetic elements remains fixed, it may be said that the 
probability qf monographic coincidence in random text oj a 26-element alphabet is .0385. The fore- 
going italicized expression * is important enough to warrant assigning a special symbol to it, viz, 
k t (read “kappa sub-r”). For a 26-element alphabet, then, x r =.0385. 

(2) Now if one asks: “Given a random assortment of 10 letters, what are the respective 
probabilities of occurrence of 0, 1, 2, . . . angle-letter coincidences?” one proceeds as follows. 
As before, it is first necessary to find the mean or expected number of coincidences and then 
refer to the various probability curves. To find the mean, one reasons as follows. Given a 
sequence of 10 letters, one may begin with the 1st letter and compare it with the 2d, 3d, . . . 10th 
letter to see if any two letters coincide; 9 such comparisons may be made, or in other words there 
are, beginning with the 1st letter, 9 opportunities for the occurrence of a coincidence. But 
one may also start with the 2nd letter and compare it with the 3d, 4th . . . 10th letter, thus 
yielding 8 more opportunities for the occurrence of a coincidence, and so on. This process may 
continue until one reaches the 9th letter and compares it with the 10th, yielding but one oppor- 
tunity for the occurrence in question. The total number of comparisons that can be made is 
therefore the sum of the series of numbers 9, 8, 7, . . . 1, which is 45 comparisons.* Since in 
the 10 letters there are 45 opportunities for coincidence of single letters, and since the probability 



1 The expression itself may be termed a parameter, which in mathematics is often used to designate a constant 
that characterizes by each of ita particular values some particular member of a system of values, functions, etc. 
The word is applicable in the case under discussion because the value obtained fore, is .0385; for a 25-element 
alphabet, k,— .0400; for a 27-element alphabet, *,= .0370, etc. 



* The number of comparisons may readily be found by the formula 



»>(w— 1) 



> where n is the total number 



of letters involved. This formula is merely a special case under the general formula for ascertaining the number 

n/ 



of combinations that may be made of n different things taken r at a time, which is ,C r » 



r/(n— r)/ 



In the 
n! 



present case, since only two letters are compared at a time, r is always 2, and hence the expression r f^ n __ r y 



which is the same as 



n(n— 1) (»— 2)/ 
2 (*- 2 )/ ’ 



becomes by cancellation of the term (n— 2)/ reduced to 







REF ID : A64565 



114 

for monographic coincidence in random text is .0385 the expected number of coincidences is \ 
.0385X45 = 1.7325. With m— 1.7 one consults the various probability curves and an approxi- 
mate distribution for exactly and for at least 0,1, 2, . . . coincidences may readily be ascertained. 4 

e. (1) Now consider the matter of monographic coincidence in English plain text.' Follow- 
ing the same reasoning outlined in subpar. d (1), the probability of coincidence of two A's in plain 
text is the square of the probability of occurrence of the single letter A in such text. The 
probability of coincidence of two B’s is the square of the probability of occurrence of the single 
letter B, and so on. The sum of these squares for all the letters of the alphabet, as shown in 
the following table, is found to be .0667. i 



Letter 


Frequency > in 
1,000 letters 


Probability of sep- 
arate occurrence 
of the letter 


Square of proba- 
bility of separate 
occurrence 


A 


73. 66 


0. 0737 


0. 0054 


B 


9. 74 


. ' ' 


. 0001 


C 


30. 68 




. 0009 




42. 44 


. 0424 


. 0018 


E 


129. 96 




. 0169 


F .... 


28. 32 






G 


16. 38 




pH;! 


H. 


33. 88 






i : 


73. 52 


. 0735 




j 


1. 64 


. 0016 




K ... . 


2. 96 






L 


36. 42 






M 


24. 74 






N 


79. 50 


1 




0 


75. 28 


i 


■H 




26. 70 




. 0007 


Q ..... 


3. 50 








75. 76 








61. 16 


. 0612 






91. 90 




. 0084 


u 


26. 00 






V 


15. 32 




■ : x ■ 


w_..._. 


15. 60 




■ ■ 


X.... 


4. 62 


. 0046 




Y 


19. 34 


. 0193 




7. 


. 98 


. 0010 




Total .. 


1.000. 00 


1. 0000 


. 0667 


1 The data given are taken from Table 3, Appendix 1, Military Cryptanalysis, Part I. 



This then is the probability that any two letters selected at random in a large volume of 
j normal English telegraphic plain text will coincide. Since this value remains the same so long 

i as the character of the language does not change radically, it may be said that the probability 

of monographic coincidence in English telegraphic plain text is .0667, or k p =.0667. 

• The approximation given by the Poisson distribution in the case of single letters is not as good as that 
I in the case of digraphs, trigraphs, etc., discussed in paragraphs 3, 4, below. 

i * The theory of monographic coincidence in plain text was originally developed and applied by the author 

j ; in a technical paper written in 1925 dealing with his solution of messages enciphered by a cryptograph known 

as the “Hebern Electric Super-Code.” The paper was printed in 1934. 
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(2) Given 10 letters of English plain text, what is the probability that there will be 0, 1, 

2, .. . single-letter coincidences? Following the line of reasoning in subparagraph d (2), the 
expected number of coincidences is .0667X45=3.00, or wi=3. The distribution for exactly and 
for at least 0, 1 , 2, . . . coincidences may readily be found by reference to the various probability 
curves. (See footnote 4.) 

j. The fact that k p (for English) is almost twice as great as k t is of considerable importance 
in cryptanalysis. It will be dealt with in detail in a subsequent text. At this point it will mere- 
ly be said that k, and k t for other languages and alphabets have been calculated and show con- 
siderable variation, as will be noted in the table shown in paragraph 3d. 

3. Data pertaining to digraphs. — a. (1) The foregoing discussion has been restricted to 
questions concerning single letters, but by slight modification it can be applied to questions 
concerning digraphs, trigraphs, and longer polygraphs. 

(2) In the preceding cases it was necessary, before referring to the various probability 
curves, to find the mean or expected number of occurrences of the event in question in the 
total number of cases or trials being considered. Given a piece of random text totalling 100 
letters, for example, what is the mean (average, probable, expected) number of occurrences of 
digraphs in this text? Since there are 676 different digraphs, the probability of occurrence 

of any specified digraph is =.00148; since in 100 letters there are 99 digraphs (if the letters 

are taken consecutively in pairs) the mean or average number of occurrences in this case is 
.00148X99=. 147. Having the mean number of occurrences of the event under consideration, 
one may now find the answers to these questions: What is the probability that any specified 
digraph, say XY, will not occur? What is the probability that it will occur exactly 1, 2, 

3, . . . times? At least 1, 2, 3, . . . times? 

(3) Again the probability curves may be used as before, for the type of distribution is the 
same. The following values are obtainable by reference to the various curves, using the mean 
value .00148X99=. 147. 

100 letters of random text 



Frequency 

<*) 


Probability that 
a specified digraph 
will occur exactly 
* times 


Probability that 
a specified digraph 
will occur at least 
x times 


Probable number 
of digraphs ap- 
pearing exactly 
x times 


Probable number 
of digraphs ap- 
pearing at least 
x times 


0 


0. 86 


1.00 


581. 36 


676.00 


1 


.13 


. 14 


87.88 


94.64 


2 


.01 


.01 


6.76 


6. 76 


3 


.00 


.00 


0. 00 


0.00 



(4) Thus it is seen that in 100 letters of random text the probability that a specified digraph 
will occur exactly once, for example, is .13 ; at least once, .14 ; at least twice, .01. The probability 
that a specified digraph will occur at least 3 times is negligible. (By calculation, it is found to 
to be .0005.) 

b. (1) The probability of digraphic coincidence in random text based upon a 26-element 
alphabet is of course quite simply obtained: since there are 26 2 different digraphs, the probability 

of selecting any specified digraph in random text is The probability of selecting two iden- 
tical digraphs in such text, when the digraphs are specified, is Since there are 26 2 

different digraphs, the probability of digraphic coincidence in random text, k,», is 26 2 X^=2^2= 
,00148. 
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(2) Given a random assortment of 100 letters, what is the probability of occurrence of 
0, 1, 2, . . . digraphic coincidences? Following the line of reasoning in paragraph 2d (2), in 
100 letters the total number of comparisons that may be made to see if two digraphs coincide 
is 4,851. This number is obtained as follows: Consider the 1st and 2d letters in the series of 
100 letters; they may be combined to from a digraph to be compared with the digraphs formed 
by combining the 2d and 3d, the 3d and 4th, the 4th and 5th letters, and so on, giving a total of 
98 comparisons. Consider the digraph formed by combining the 2d and 3d letters; it may be 
compared with the digraphs formed by combining the 3d and 4th, 4th and 5th letters, and so on, 
giving a total of 97 comparisons. This process may be continued down to the digraph formed 
by combining the 98th and 99th letters, which yields only one comparison, since it may be 
compared only with the digraph resulting from combining the 99th and 100th letters. The 
total number of comparisons is the sum of the sequence of numbers 98, 97, 96, 95, . . . 1, which 
is 4,851.* 

(3) Since in the 100 letters there are 4,851 opportunities for the occurrence of a digraphic 
coincidence, and since k,’ =. 00148, the expected number of coincidences is .00148X4851= 
7.17948=7.2. The various probability curves may now b8 referred to and the following results 
are obtained: 

Distribution for 100 letters of random text 



Frequency (x) 


Probability lor exactly z 
digraphic Coincidences 


Probability for at least x 
digraphic coincidences 


0 


0. 001 


1.000 


1 


. 005 


. 999 


2 


.019 


. 994 


3 


.046 


. 975 


4 


.083 


.929 


5 


. 120 


.846 


6 


. 144 


. 726 


7 


. 148 


.582 


8 


. 134 


.434 


9 


.107 


.300 


10 


.077 


. 193 


11 


.060 


. 116 



c. In this table it will be noted that it is almost certain that in 100 letters of random text 
there will be at least one digraphic coincidence, despite the fact that there are 676 possible 
digraphs and only 99 of them have appeared in 100 letters. When one thinks of a total of 676 
different digraphs from which the 99 digraphs may be selected it may appear rather incredible 
that the chances are better than even (.582) that one will find at least 7 digraphic coincidences in 
100 letters of random text, yet that is what the statistical analysis of the problem shows to be 
the case. These are, of course, purely accidental repetitions. It is important that the student 
should fully realize that more coincidences or accidental repetitions than he feels intuitively 
should occur in random text will actually occur in the cryptograms he will study. He must 
therefore be on guard against putting too much reliance upon the surface appearances of the 
phenomena of repetition; he must calculate what may be expected from pure chance, to make 
sure that the number and length of the repetitions he does see in a cryptogram are really better 
than what may be expected in random text. In studying cryptograms composed of figures this 



• The formula for finding the number of comparisons that can be made is as follows, where n=the total 
number of letters in the sequence and t i s the length of the polygraph: No. of comparisons =— — 
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is very important, for as the number of different symbols decreases the probability for purely 
chance coincidences increases. 

d. (1) For convenience the following values of the reciprocals of various numbers from 20 to 
36, and of the reciprocals of the squares, cubes, and 4th powers of these numbers are listed: 




1/I> 




l/** 


0. 002500 


0. 000125 


0. 00000625 


. 002266 


. 000108 


. 00000514 


. 002070 


. 000094 


. 00000429 


. 001892 


. 000082 


. 00000358 


. 001739 


. 000073 


. 00000302 


. 001600 


. 000064 


. 00000256 


. 001482 


. 000057 


. 00000220 


. 001369 


. 000051 


. 00000 1'87 


. 001274 


. 000046 


. 00000162 


. 001190 


. 000041 


. 00000142 


. 001109 


. 000037 


. 00000123 


. 001043 


. 000034 


. 00000109 


. 000980 


. 000031 


.00000096 


. 000918 


. 000028 


. 00000084 


. 000864 


. 000025 


. 00000075 


.000818 


. 000023 


.00000067 


. 000773 


. 000021 


. 00000060 




(2) The following table gives the probabilities for monographic and digraphic coincidence 
for plain-text in several languages. 




Language 



English.. 
French. . 
German . 
Italian.. 
Spanish. 




0. 0069 
.0093 
' . 0112 
. 0081 
. 0093 




4. Data pertaining to trigraphs, etc. — a. Enough has been shown to make clear to the student 
how to calculate probability data concerning trigraphs, tetragraphs, and longer polygraphs. 

b. (1) For example, in 100 letters of random text the value of m (the mean) for trigraphs 
is .00005689X100 ==.005689. With so small a value, the probability curves are hardly usable, 
but at any rate they show that the probability of occurrence of a specified trigraph in so small 
$ volume of text is so small as to be practically negligible. The probability of a specified trigraph 
occurring twice in that text is an even smaller quantity. 

(2) The calculation for finding the probability of at least one trigraphic coincidence in 100 
letters of random text is as follows : 

w=g (~ lT ") Gf 3 )"" 4 ’ 753 X ■ 00005ml2== -2704= .27 

Referring to curve / 0 , with m =. 27 the probability of finding no trigraphic coincidence is .76. 
The probability of finding at least one trigraphic coincidence is therefore 1— .76 =.24. 

c. The calculation for a tetragraphic coincidence is as follows: 



'96X97 



)G 1 6‘)~ 4, 



656X. 0000021883 =.0101=. 01 



Referring to curve / 0 , with m=.01 the probability of finding no tetragraphic coincidence is 
so high as to amount almost to certainty. Consequently, the probability of finding at least 

182018-38 9 
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one tetragraphie coincidence is practically nil. (It is calculated to be .0094 = approximately .01, 
This means that in a hundred cases of 100-letter random-text cryptograms, one might expect 
to find but one cryptogram in which a 4-letter repetition is brought about purely by chance; it 
is, in common parlance, a “hundred to one shot.”) Consequently, if a tetragraphie repetition 
is found in a cryptogram of 100 letters, the probability that it is an accidental repetition is 
extremely small. If not accidental, then it must be causal, and the cause should be ascertained. 

5. An example. — a. The message of Par. 9a of the text proper will be employed. First, let 
the repetitions be sought and underlined ; then the repetitions are listed for convenience. 



A. 


U S Y E 


S 


E 


C 


P 


M 


P 


L 


C 


C 


L 


N 


X B 


W 


C 


S 


0 


X 


UVD 


B. 


S C R H 


T 


H 


X 


I 


P. 


JL 


I 


B_ 


_C 


I 


J 


U S 


Y_ 


J 


E 


G 


U 


R D P 


C. 


A Y BJL 


X 


0 


F 


P 


J 


W 


J 


E 


M 


G 


P 


X V 


E 


U 


E 


L_ 


_E 


J Y Q 


D. 


M U S_C 


X 




x 


M 


S 


G 


L 


L_ 


J 


T 


A 


L E 


D 


E_ 


_C 


G 


B 


MFI 



Group 


Number of 
occurrences 


BC 


2 


CX 


2 


EC 


2 


LE 


3 


JY 


2 


PL 


2 


SC 


2 


SY 


2 


US 


3 


YE 


2 


SYE 


2 


USY 


2 


USYE 


2 



b. Referring to the table in Par. 3 a (3) above, it will be seen that in 100 letters of random 
text one might expect to find about 7 digraphs appearing at least twice and no digraph appearing 
3 times. The list of repetitions shows 8 digraphs occurring twice and 2 occurring 3 times. 

c. Again, the list of repetitions shows 10 digraphs each repeated at least twice; the table in 
Par. 36 (3) above shows that in 100 letters of random text the probability of finding at least 
that many digraphic coincidences is only .193. That is, the chances of this being an accident are 
but 176 in a thousand; or another way of expressing the same thing is to say that the odds against 
this phenomenon being an accident are as 807 is to 193 or roughly 4 to 1. 

d. The probability of finding at least one trigraphic coincidence in 100 letters of random 
text is very small, as noted in Par. 4 b; the probability of finding at least one tetragraphie coin- 
cidence is still smaller (Par. 4c). Yet this cipher message of but 100 letters contains a repetition 
of this length. 

e. A consideration of the foregoing leads to the conclusion that the number and length of the 
repetitions manifested by the cryptogram are not accidental, such as might be expected to occur 
in random text of the same length; hence they must be causal in their origin. The cause in this 
case is not difficult to find: repeated isolated letters and repeated sequences of letters (digraphs, 
trigraphs) in the plain text were actually enciphered by identical alphabets, resulting in producing 
repeated letters and sequences in the cipher text. 
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